Security
You are deciding whether payroll, the ledger and commercial documents can sit on Rely. They sit against your organisation. Another customer cannot open them. Bank account, national ID, phone and KRA PIN are encrypted before they are stored. On Growth and Enterprise, the person who prepares a pay run cannot approve it. The security log cannot be rewritten. That is the promise. It sits with the Privacy Policy and the Data Processing Agreement.
Take these into the review. They are the controls Rely Finance commits to for your organisation, under Kenya’s Data Protection Act, 2019.
Your payroll, ledger, invoices, bills and security log are stored against your organisation. The API accepts a call only after it confirms the signed-in person belongs to that organisation. The Rely platform organisation is separate from yours. A new organisation stays closed until Rely approves it.
People sign in through Rely Auth with a verified email address. The finance session is a signed token in an HTTP-only cookie, limited to eight hours. You assign owner, admin, approver, editor or viewer. Growth and Enterprise can add narrower custom roles. A viewer can read. Editing, submitting, approving and exporting stay separate permissions.
Bank account, national ID, phone number and KRA PIN are encrypted in the browser with AES-256-GCM before they are saved. Each organisation has its own data key and that key is wrapped before it is stored. Opening the fields requires the decrypt permission and issuing the key is written to the security log. Names, gross pay and ledger amounts stay available to the payroll and accounting engines so the books can be calculated.
Growth and Enterprise split the person who prepares work from the person who approves it. The submitter of a payroll run cannot approve that run. A custom role cannot hold both submit and approve or both post and approve, for payroll and for finance. Owner and admin remain full-control roles. Starter runs payroll without that split.
Sign-in failures, access denials, role changes, payroll approval, journal posts and encryption-key use are recorded. The database refuses updates and deletes of those rows. Your organisation admins read the log in the product. Starter shows the latest 20 events. Growth and Enterprise show the full history.
finance.rely.co.ke is served over HTTPS. Pages send X-Content-Type-Options, X-Frame-Options and a strict referrer policy. Session cookies are HTTP-only. The API rate-limits bursts of requests and records the block.
You decide why employee, customer and vendor data is processed. Rely processes that data to run payroll, the ledger and receivables and payables. The Data Processing Agreement is your written instruction for that work.
Your people ask you for access, correction or deletion. Rely helps you respond. If Rely becomes aware of a personal-data breach affecting your data, Rely tells you without undue delay so you can meet your notice duties, including to the Office of the Data Protection Commissioner.
Infrastructure, email, sign-in and payments use sub-processors under written terms. Ask support@rely.co.ke for the current list. Transfers outside Kenya follow the Act and the Data Processing Agreement.
Send the review to support@rely.co.ke. Name the organisation and the controls you want mapped. We answer from this page and the Data Processing Agreement.