Privacy Policy

1. Strict Multi-Tenant Data Isolation

RhoBill employs strict tenant boundary isolation across our database layers, cache tiers, and real-time event streaming protocols. Each ISP organization's customer records, payment ledgers, router configurations, and voucher batches are cryptographically partition-keyed. Cross-tenant data leakage is structurally prohibited by our database schema and security invariants.

2. Subscriber Information Collected

When end-users connect to an operator's captive portal or renew their PPPoE fiber subscriptions, RhoBill processes only the data strictly necessary to authenticate and meter network access:

• M-Pesa transaction reference numbers and payment amounts.
• Safaricom telephone numbers used for M-Pesa STK push checkouts.
• Client hardware MAC addresses and assigned local IP addresses.
• Bandwidth consumption totals (bytes uploaded and downloaded).

3. Zero-SMS Discovery & Captive Authentications

RhoBill adheres to RFC 8908 and RFC 8910 standards for Captive Portal Architecture. We do not store plaintext subscriber credentials. HotSpot access is provisioned securely through dynamic RADIUS credentials generated on the fly.

4. Third-Party Integrations

Financial transactions are processed directly via Safaricom Daraja API endpoints. RhoBill does not store customer banking passwords or PIN numbers.

5. Data Retention & Deletion

Operators retain ownership of their customer lists and voucher records. Upon tenant closure, operator data can be exported in standard formats and purged from our primary database stores upon request.