Skip to content
Kaawa
Kaawa
PlatformContest EngineSurveyorsVerify a DDS
Sign inRequest a demo
Loading
Verify a DDSSecurity & trustFAQPrivacyTerms
© 2026 Kaawa
PlatformContest EngineSurveyorsVerify a DDS
Request a demo
Verify a DDSFAQPrivacyTermsDPA
© 2026 Kaawa
Security & trust

Where we stand, stated plainly

Farmer data collected in Uganda flows into an EU regulatory system, so GDPR applies from the first record. Certifications are listed with their real status. We never claim one we don't hold.

Certification status · 30 October 2026

StandardStatusWhat that means
GDPR
In force
Named controller and processor roles in every contract, data processing agreement available, five-year retention with defined deletion.
Security whitepaper
Planned
Architecture, tenancy model, encryption, access logging. In preparation; shared under NDA.
SOC 2 Type I
Planned
Scheduled once paying customers are onboarded. Not yet held.
SOC 2 Type II · ISO 27001
Not started
When revenue justifies the audit. We will update this row, not our claims.

Farmer personal data

  • Names encrypted at rest
  • National IDs stored only as salted hashes
  • Recorded, revocable consent — FPIC requires it regardless
  • Data minimisation into every statement payload
  • Collected in the farmer's language, read back before it is saved

Tenancy and access

  • Each organisation isolated by row-level security in the database, not application code
  • Surveyors see only gardens in their accepted jobs; commercial tables carry no surveyor access at all
  • Filing authority restricted to Org Admins unless explicitly granted to a named member
  • Support impersonation writes an immutable audit record your admins can read

Records and reproducibility

  • Five-year immutable, hash-chained retention
  • Any statement regenerable from source records with the dataset and methodology versions in force on its filing date
  • Every Tier 2 and Tier 3 disclosure logged and visible to the exporter
  • Usage metered on acceptance, one immutable line per bag

Legal posture

  • Kaawa files as agent under the operator's credentials, never its own identity — stated in contract and in the product
  • Contractual prohibition on selling farmer-level data or trading on aggregated supply intelligence
  • Delaware entity; data processing agreement on request
  • Not legal advice: your counsel reviews your obligations
Running a security review?We answer questionnaires and share architecture diagrams under NDA; the whitepaper follows when it is written.
Contact security
Sign inRequest a demo