Home › Services › Secure web and application development
Secure web and application development
Most websites and business systems are built first and secured later, if at all. APOPS Assurance is a cybersecurity and IT audit firm, so we build the other way round. Security, privacy and audit trails are designed in from the first sketch, the code is tested against the OWASP Top 10 before launch, and you get a system your auditors, bank and customers can trust. We build company websites, customer portals, staff portals, online shops and internal tools for Kenyan organisations.
What we build
- Company websites that load fast, rank on Google and read well to AI assistants
- Customer portals and self-service pages: invoices, statements, receipts and payments
- Staff portals with role-based access: approvals, work orders, commissions and reports
- Online shops with M-Pesa, bank and card payments
- Internal tools that replace spreadsheets and paper: registers, trackers and dashboards
- Fixes, security hardening and new features for systems you already have
Security built in, not bolted on
- Threat modelling before coding: what could go wrong, who could misuse it, and how we stop it
- Strong sign-in: multi-factor authentication (authenticator app or one-time codes), lockouts and session time-outs
- Role-based access, so each person sees and does only what their job needs
- Two-person approval (maker-checker) for money, prices and other sensitive changes
- Tamper-evident audit trails that show who did what and when
- Secrets kept out of code, encrypted where stored, and never sent to the browser
- Testing against the OWASP Top 10 and OWASP ASVS, with a security review before every release
Privacy by design (Kenya Data Protection Act)
Personal data is collected only where needed, protected in storage and transit, kept only as long as necessary, and visible only to the people who need it. We document what the system holds and why, which helps with Data Protection Act registration, privacy notices and data subject requests. Because we also audit systems, we build what an auditor expects to see.
How a project runs
- Discovery: we agree the problem, the users, the data and the risks
- Design: screens, workflows and a security plan you approve before we build
- Build in short stages, with a working version you can try early
- Security testing and fixes, then a guided launch
- Handover: documentation, admin training and a support plan
Why APOPS Assurance
- Founded in 2016 in Nairobi, working with businesses and institutions across Kenya
- One team for both IT security and physical security, so cameras, access control and networks are designed together
- Our own technicians and auditors, with ISO/IEC 27001 Lead Auditor and information systems audit expertise
- Clear written quotations, and help after installation
Frequently asked questions
Why use a cybersecurity firm to build our website or system?
Because fixing security after launch costs more and leaves you exposed meanwhile. We design sign-in, access, data protection and audit trails from the start and test them before launch. You also get a team that can audit, monitor and support the system afterwards.
Do you take over systems built by someone else?
Yes. We start with a security and code review, fix the urgent issues, then maintain and improve the system.
Who owns the code and the data?
You do. On handover you receive the code, documentation and admin access. Your data stays in your hosting or cloud account.
Can you host and maintain the system?
Yes. We can manage hosting, updates, backups, monitoring and security patches under a monthly support plan, or hand everything to your own IT team.
How much does a custom portal or website cost?
It depends on the features, users and integrations. After a short discovery session we give a fixed quote in stages, so you know the cost before work starts.
Talk to us
Call +254 722 102 317, email info@apopsassurance.com or visit us at Kimathi House, Kimathi Street, Nairobi.