Security and data
Built to be trusted with the record
A project record is only useful if nobody can tamper with it and nobody sees what isn't theirs. This is how JengaTrack is built for both.
Your records stay in your organisation
Everything belongs to an organisation, never to one person, and every request is checked against the organisation it belongs to. Another firm's record simply doesn't exist for you. Our automated tests try every page with another firm's records to make sure.
You choose what other firms see
A firm on your project sees its name, its Project ID, the firms on it and what you share with it. Never your client, your drafts or your rates. A firm you remove loses access at once.
Files that can't carry surprises
Uploaded images are redrawn from scratch, so hidden data such as location doesn't survive. PDFs must be real PDFs. Files are kept off the public web and only ever leave through JengaTrack, as a download, to people allowed to see them.
Records that can't be quietly changed
Issued documents are locked, payments and project records are append-only, and every entry and file carries a fingerprint that shows if it was changed later.
Careful sign-in
Email addresses are verified, passwords are stored only in scrambled form, repeated sign-in attempts are slowed down, and JengaTrack staff confirm a code sent to their email before they can reach the admin pages.
Private pages stay private
Every private page and file tells search engines not to index it and browsers not to keep a copy. Only what a firm chose to publish, such as an approved shop, is public.
Payments through Paystack
JengaTrack's own fees are paid through Paystack. We never see your card number or M-Pesa PIN, and a payment counts only once Paystack confirms it to our server.
Email that's honest about delivery
Every alert and document email records whether it was sent, waiting for the hourly limit, or failed. A failed email is never shown as sent.
Your data and the law
JengaTrack is built in Kenya, for Kenya's Data Protection Act, 2019. We collect what the service needs, use it to run the service, and never sell it or show you advertising. The privacy policy sets out what we keep, who sees it, how long we keep it and your rights, including deleting your account yourself under Your account.
What we haven't done yet
- An independent security test by an outside firm is planned before public launch. Until then, our checks are our own automated tests.
- A legal review of our terms and privacy policy is planned. They describe exactly what the software does today.
Found a security problem? Please tell us privately, and we'll fix it and let you know.
See it with real-looking work
The demo is a practice with sample projects, BOQs and records. Look around, edit and create, with nothing to sign up for.