LEGAL
Security
Protection should be visible before an incident.
Kimpa brings end-to-end protection by Ollandi, fraud and impersonation warnings, account protection, and administrative controls into one operating model.
Every plan includes end-to-end protection by Ollandi, impersonation and fraud warnings, spam and malware filtering, and Kimpa Verified checks. Administrators also have session control, mailbox suspension, and audit activity.
Our approach to security
Security at Kimpa is treated as an operating standard, not a feature. We combine encrypted communication, identity verification, abuse prevention, and administrative controls so that protection is visible at the point someone needs to make a decision, not only after an incident.
Encryption
Messages carry end-to-end protection by Ollandi, Glemad's own security technology, in transit and at rest within the Services. Administrative access to encrypted content is restricted and logged.
Identity and access control
Accounts are protected by authentication controls, and administrators can enforce organization-wide policies, manage sessions, and suspend compromised accounts. Access to customer data by Glemad personnel is limited to what is needed to provide and support the Services, and is subject to confidentiality obligations.
Threat and impersonation protection
Every plan includes spam and malware filtering and impersonation warnings that surface domain and sender evidence before a recipient acts on a message. Kimpa Verified lets organizations connect a reviewed identity to outbound mail so recipients can see which organization stands behind it.
Infrastructure resilience
The Services are built with redundancy, monitoring, and backup practices designed to protect availability and recover from failure. Consistent with standard security practice, we do not publish architecture, hosting, or infrastructure details that could help an attacker.
Vulnerability management
We maintain a process to identify, assess, and remediate vulnerabilities across the Services. If you believe you have found a security vulnerability, please report it to security@glemad.com rather than disclosing it publicly; we will acknowledge and investigate reports in good faith.
Incident response
We maintain a process to detect, contain, and investigate security incidents. Where an incident is confirmed to affect your data, we will notify you without undue delay, and will cooperate with any legally required notification to affected individuals or regulators.
Data protection and no advertising use
We do not sell personal data or use the content of private communications to build advertising profiles. Our data-handling practices are described in full in our Privacy Policy.
Compliance
We process personal data consistent with the Nigeria Data Protection Act 2023 and, where applicable, the data protection laws of the regions our customers operate in.
Shared responsibility
Security is a shared responsibility. You are responsible for safeguarding your account credentials, configuring your organization's security settings appropriately, and promptly reporting suspected compromise.
Report a concern
Reach our security team at security@glemad.com. For account-specific support, contact help@kimpa.io.