Due diligence
Trust and data security
What a risk, compliance or data team needs to check before relying on Afronomics: where each dataset comes from, how and how often it is read, how we know it is current, how errors are corrected, and how the site and API are secured. Everything below is generated from the data files or describes what the code does today. Where something is not in place yet, it says so.
Security questionnaire?
Send your vendor or data-security questionnaire and we complete it. Buying process, invoices and licence terms are on buying for an institution.
desk@afronomicsfeed.comAuction results held
19,779
17 bill and bond datasets
Counted from the data files at build
Figures checked for freshness
39
30 up to date · 8 late · 1 not available
Last check 4 Nov 2026
Median delay after publisher
2.8 hours
19 of 47 new results carry a publisher time
Publication delay, on the data status page
Reading schedule
Every 2 h
07:17–21:17 Nairobi on weekdays; four times a day at weekends
Scheduled data run
Provenance
Where each auction dataset comes from
One row per dataset. The publisher link goes to the official results page we read; every row inside a dataset links to its own notice or document.
Some publishers date results by settlement rather than auction day; each market page says which. Macro series, currencies and the Wire are sourced as described on sources and method.
Collection
How the data is read
- One reader per publisher downloads the publisher’s own published results (a web page, a PDF or a spreadsheet) on a schedule: every two hours from 07:17 to 21:17 Nairobi time on weekdays and four times a day at weekends, plus every 20 minutes on Thursday afternoons, when Kenya’s bill results are due.
- The reader extracts each result into one shape (rate, tenor, amounts offered, received and accepted, and the source document’s address) and adds it to the market’s data file. Figures are never typed in by hand, estimated or written by a language model.
- Data files are kept under version control, so every change to every figure has a dated record of what changed. Readers have automated tests against publisher documents.
- After each run, a freshness check compares every dataset with its publisher’s own rhythm and lists anything late or unreadable on the data status page, and the delay between the publisher’s release and our first record is measured per result (publication delay).
Changes and errors
Corrections and change history
- A figure that changes after publication (a restatement, a misread document, a duplicated row) is logged with what was wrong, what changed and why in the data corrections log. Corrections to articles are on the corrections page.
- Definitions of each market’s rate, the index method and the record of when each result was first seen are on the reference.
- Report a data issue: desk@afronomicsfeed.com with the subject “Data issue”, the page and the figure.
Security
How the site, API and your data are protected
As checked in our security review of 13 October 2026.
Encrypted in transit
The site and API are served only over HTTPS, with HTTP Strict Transport Security (two years, subdomains included).
Browser hardening
Every page sends nosniff, a strict referrer policy and a permissions policy that turns off camera, microphone and location. Pages cannot be framed by other sites, except the widgets made for embedding. A Content-Security-Policy runs in report-only mode while it is tuned.
API keys
Keys are accepted only in a request header (Authorization or X-API-Key), never in a URL. We store only a one-way SHA-256 hash of each key, never the key itself, and never write keys to logs. Keyed responses are marked private and are not cached.
Pilot keys
A pilot key is sent only to the work email address that asked for it; it is not shown on screen. Pilot keys expire after 30 days.
Database access
Row-level security is on for every table. Tables that hold personal data (leads, subscribers, payments, keys) have no public read policy; only server functions holding a secret can reach them.
Payments
Card and mobile-money payments are taken by Paystack. Afronomics receives the email, plan and payment status, never full card details. Payment notifications are verified by signature before anything is recorded.
No advertising trackers
No third-party analytics or ad networks. Page counts are kept without cookies and without storing IP addresses (see the privacy notice).
Logs
Server logs and error messages are written without email addresses: requests are logged by domain or payment reference.
Dependencies
Framework security advisories are tracked and patched; the last full review (13 October 2026) upgraded the web framework to a patched release and found no secrets in the code or its history.
Sub-processors
Who processes data for us
| Vercel | Hosts the website and API. |
|---|---|
| Supabase | Database for leads, subscribers, API keys, payments records and usage counts. |
| Paystack | Takes payments (card, M-Pesa, bank transfer). |
| Resend | Sends transactional and newsletter email. |
| GitHub | Holds the code and the published data files, and runs the scheduled data readers. |
Personal data is handled under Kenya’s Data Protection Act, 2019; see the privacy notice.
Not yet in place
What we do not have today
- No SOC 2 or ISO 27001 certification.
- No published uptime figure or uptime commitment for the open site and API. Service levels are agreed per contract on Enterprise.
- No written data-retention schedule yet; you can ask us to delete your data at any time.
- The Content-Security-Policy is in report-only mode, not yet enforced.
We list these so your review does not have to find them. Ask about any of them at desk@afronomicsfeed.com.