Trust & Security

Passwords are never stored in plain text — they're hashed with bcrypt before touching the database. Optional two-factor authentication (email code) is available to every business owner from Settings. Login and password-reset attempts are rate-limited to slow down brute-force attempts.

Business owners can add team members with their own individual logins and grant access only to the specific areas of the platform each person needs — Orders, Accounting, Social Media, and more are each independently controllable. Every action anyone takes is logged with who did it, visible to the business owner in Reports.

All traffic to Intumwa is encrypted over HTTPS. Data is stored on managed database infrastructure (Turso/libSQL) with automated backups, not on a server we hand-maintain ourselves.

Every business can export its own data — subscribers, products, orders, funnels — at any time from Settings, and delete their account entirely if they choose. We do not sell personal data to third parties. Full detail in our Privacy Policy.

When a business connects Facebook, Instagram, Google Business, MTN MoMo, or Wave Accounting, Intumwa stores only the access token needed to perform the actions that business explicitly authorizes — publishing a post they wrote, collecting a payment they requested, recording a transaction they made. Nothing is posted or charged without an action the business owner initiated.

Intumwa is a growing platform, not a large enterprise vendor — we haven't pursued formal certifications like SOC 2 or ISO 27001, and we won't claim them. What's above is a plain account of what's actually built today. Questions about anything here: nsabidida@gmail.com.