Trust & Security
How GETYOURHOME verification, scoring and security actually work
Every trust signal on GETYOURHOME is computed from evidence, published openly, and explained in full on this page — not asserted and left for you to take on faith. This is the complete picture: what the verification badges mean and how you earn each one, exactly how the Trust Score is calculated down to the weight of every component, what can never influence it no matter who asks, how we protect the data and money that pass through the platform, and precisely what happens — step by step — when something goes wrong.
The 4-level verification ladder
Verification is cumulative: each level requires everything below it plus one additional, independently checked credential. A provider's badge always shows their highest completed level, and every level is visible on their profile so a Seeker can see exactly what has — and hasn't — been checked.
Level 1 — Phone verified
A one-time SMS code sent to the phone number on the account confirms the provider actually controls that number.
This is the minimum bar to publish any Listing. It proves reachability, not identity — a Level 1 badge alone tells a Seeker "we can reach this person," nothing more, which is why it carries the lowest weight in the Trust Score below.
Level 2 — National ID verified
Government-issued ID is checked through our KYC partner, Smile Identity, using document and liveness verification. The name on the ID must match the name on the account.
This is where a real, accountable human is attached to the account. KYC checks typically resolve within minutes; if a check fails (blurry document, name mismatch, liveness failure), the account is told exactly why and can retry — we never silently reject without a reason.
Level 3 — Business / agency registration
For Agent/Broker and Developer/Investor accounts: the business registration certificate and, where applicable, the agency's professional licence, cross-checked against the relevant public Kenyan registries.
This level exists because an individual can pass Level 2 and still misrepresent who they work for. Cross-checking the registration means the agency named on a Listing is a real, registered entity — not a name typed into a profile field.
Level 4 — Ownership verified
Title deed, head-lease, or a landlord's signed authorisation letter is cross-checked so the person or agency listing a specific property actually has the right to let or sell it.
Level 4 is verified per-property, not once for the account — an agency verified at Level 4 for one listing must still show the paperwork for the next one. This is the highest bar on the platform and the strongest signal we can give a Seeker that a Listing is genuine.
The Trust Score (0–5)
The score is recomputed automatically, on a schedule, from the weighted components below. There is no form, field, or admin action anywhere in our systems that lets a human type in a number — the score is a pure function of the evidence.
| Verification ladder progress — how far up the four levels above the account has climbed | 30% |
| Proof-of-life freshness — confirmed via 30-day photo re-verification (see below) | 20% |
| Reviews from real, verified stays and viewings, time-decayed so old reviews matter less than recent behaviour | 15% |
| Inquiry response rate and speed — how reliably and quickly a provider replies to genuine Seeker messages | 10% |
| Listing completeness — photos, true costs, utilities, an accurate map pin, and other fields that make a Listing actually useful | 10% |
| Completed Safe-Meet viewings — a track record of real, confirmed in-person visits, not just messages | 10% |
| Provider account history — how long the account has operated on the platform without incident | 5% |
The score recomputes on every material event (a new review lands, a Safe-Meet is confirmed, a proof-of-life check completes, a fraud report resolves) and on a nightly batch pass so it never drifts stale even without new activity.
Penalties (subtracted after the weighted sum)
- Confirmed fraud report: −40 points per report — the largest single penalty on the platform, reserved for reports our trust and safety team has actually investigated and upheld
- Scam reported at a Safe-Meet viewing: −25 points — weighted heavily because it means an in-person interaction went wrong, not just a suspicious message
- Photos duplicated from another listing or lifted from elsewhere online: −20 points, detected automatically by cross-platform image matching, not by manual review alone
- Unresolved fraud report under active review: −15 points, applied the moment a report is filed so risk is reflected immediately rather than only after investigation concludes
- Proof-of-life overdue: −10 points, escalating to automatic suppression from search results if it stays overdue past 7 days
Every penalty is logged with the evidence that triggered it, visible to the affected provider in their workspace. If a provider believes a penalty was applied in error — a false fraud report, a photo that was actually theirs and simply reused across their own listings — they can dispute it through the Help Center; a human reviewer, never the person who filed the original report, decides the appeal, and the decision (uphold, reverse, or partially reverse) is itself audit-logged.
How verification actually works, technically
"Trust infrastructure" is a claim we'd rather demonstrate than assert. Here is what actually runs behind each badge.
Identity checks run through a licensed KYC provider
We do not build or store facial-recognition or document-forensics models ourselves. National ID checks are performed by Smile Identity, a KYC provider operating across Africa, which validates the document against government data sources and performs a liveness check to confirm a real, present person is completing the verification — not a photo of a photo.
Duplicate-photo detection runs automatically, platform-wide
Every photo uploaded to a Listing is checked, automatically, against every other photo already on the platform. A perceptual-hash match against another provider's Listing — not just an exact byte-for-byte copy, but a cropped, resized, or lightly edited duplicate — flags both listings for review and applies the duplicate-photo penalty above. This runs on upload, not on a delayed batch, so a copied listing is flagged before it can accumulate views.
Registry cross-checks are real lookups, not self-reported fields
Business registration and title-deed checks at Levels 3 and 4 are matched against the actual public registry records they claim to represent — not accepted at face value because a document was uploaded. Where automated lookup isn't available for a specific registry, our verification team performs the cross-check manually and records exactly what was checked, so the process is documented either way.
Money safety: why we structurally never touch your funds
GETYOURHOME does not take custody of money exchanged between a Seeker and a Provider, and we've built the platform so that this isn't a policy we could quietly change — it's an architectural fact about what the product does and doesn't do. Subscription payments from Providers to GETYOURHOME (for Host, Pro or Agency plan seats) are processed via Safaricom M-Pesa; we receive confirmation that a payment happened, never your M-Pesa PIN, and that confirmation is the only financial detail that touches our systems for that transaction. Rent, deposits, sale proceeds and service fees between users are never routed through GETYOURHOME in any form — there is no wallet, no holding account, and no feature anywhere in the product that asks you to send money to GETYOURHOME on another user's behalf. If a specific feature ever does introduce money custody, it will only do so through a named, licensed escrow partner disclosed clearly on that feature — never silently, and never by default.
- Never pay a fee to view a property — Safe-Meet viewings are always free, and any request for a viewing fee is a fraud report waiting to happen.
- Never send a deposit, rent, or purchase payment to anyone claiming to represent GETYOURHOME — we never ask for this, through any channel.
- If a specific feature names a licensed escrow partner, verify that partner's licence independently before relying on it — we will always make this easy to check, never something you have to take on faith.
Platform and data security
Trust isn't only about who's on the platform — it's also about whether the platform itself is safe to use. Some of the technical detail below is genuinely technical; we've included it because "we take security seriously" means nothing without specifics.
Passwords are never stored in a form anyone could read
Passwords are hashed with scrypt, a memory-hard algorithm specifically designed to resist large-scale cracking attempts, using a unique random salt per password. GETYOURHOME staff cannot look up your password — not because of a policy, but because the plaintext is never stored anywhere, ever, including in backups.
Session and verification tokens are stored as hashes, not raw values
Login sessions, email-verification links and password-reset tokens are stored in our database as one-way hashes of the token, not the token itself. A database breach alone would not hand an attacker usable session tokens.
Sensitive financial details are encrypted at rest, with a fail-safe
Where a Provider's payout or financial account details are stored, they're encrypted with AES-256-GCM authenticated encryption before hitting the database. If the encryption key is ever unavailable for any reason, the system refuses to store the data rather than silently falling back to storing it unencrypted.
Rate limiting protects every sensitive endpoint
Login attempts, OTP requests, password resets and other sensitive actions are rate-limited per IP address using a sliding-window limiter, making brute-force and scraping attempts impractical. IP addresses used for this are themselves stored only as salted hashes, never in plain form, consistent with our privacy-first design.
Org isolation is enforced at the database query layer, not just in the interface
Every workspace's data — listings, leads, bookings, financials, team members — is scoped by organisation at the query layer itself, through a dedicated database client extension, not by an interface simply choosing not to display another org's data. This is verified by an automated test suite specifically designed to attempt cross-tenant reads and writes and confirm every one of them fails.
Administrative actions are permanently audit-logged
Any action available only to GETYOURHOME staff — a manual fraud review, a plan change, a support intervention — is recorded in an append-only audit log: who did it, when, and why. This log is what makes our "Trust Score is never manually overridden except audit-logged fraud review" guarantee below independently checkable rather than just a promise.
Safe-Meet: how in-person viewings stay safe and free
Safe-Meet is how every in-person property viewing arranged through GETYOURHOME is meant to happen. A Seeker requests a viewing time through the Listing; the Provider confirms a specific slot; at the time of the visit, a short confirmation code — generated fresh for that specific viewing, visible to both parties in-app — is exchanged in person. Completing a Safe-Meet viewing is one of the seven weighted inputs to the Trust Score above, so providers with a genuine track record of real, confirmed viewings are rewarded for it, and a pattern of no-shows or cancellations is visible in their history.
- Safe-Meet viewings never carry a fee, under any circumstance. If anyone asks you to pay to view a property, stop and report it immediately.
- The confirmation code is generated per-viewing and expires after use — it isn't a reusable password, so it can't be shared ahead of time to fake a visit that didn't happen.
- A confirmed Safe-Meet gives both sides a verifiable record that the viewing actually took place, which matters if a dispute or a fraud report ever needs to be investigated afterward.
How fraud and scam reports actually get handled
This is the exact process, not a summary — because knowing precisely what happens after you report something is itself part of trusting the system.
1. You file a report
From any Listing, provider profile, or after a Safe-Meet viewing, you can file a fraud or scam report describing what happened. This takes under a minute and does not require you to have already contacted the provider.
2. The penalty applies immediately, provisionally
The moment a report is filed, the "unresolved fraud report under review" penalty (−15 points) applies to the reported Listing or provider. This is deliberate: risk is reflected the instant it's raised, not only after a full investigation concludes days later.
3. Our trust and safety team investigates — a human, not an algorithm
Every fraud and scam report is reviewed by a person on our trust and safety team, who looks at the report, the Listing's history, any related reports, and reaches out to the reporting party if more detail is needed. This is not an automated decision.
4. Confirmed fraud escalates immediately
If the report is confirmed, the full −40 point penalty applies. A third confirmed report against the same Workspace freezes that entire Workspace — every Listing and team member under it, not just the one flagged — pending further review, because trust is a property of the Workspace as a whole, not of a single listing.
5. Unfounded reports are dismissed, and the provisional penalty lifts
If investigation finds the report doesn't hold up, the provisional penalty is removed and the Listing's score returns to what it would have been without the report. We don't leave a permanent scar on a provider's record for a report that turned out to be mistaken or malicious.
A provider who disagrees with a confirmed finding can dispute it through the Help Center. Disputes are reviewed by a different member of the trust and safety team than the one who made the original finding, and the outcome — upheld, reversed, or adjusted — is recorded in the same audit log referenced above.
Common questions about trust on GETYOURHOME
Can a provider pay to get a higher Trust Score or better ranking?
No. There is no field anywhere in our database for paid placement, and no manual process that could add one — this is a structural fact about the product, not a policy that could quietly change.
Can GETYOURHOME staff manually raise or lower someone's score?
Only through a documented, audit-logged fraud review — never as a routine action, never on request, and never without a permanent record of who did it and why.
What does an unverified (Level 0) Listing mean?
It means the account hasn't completed even phone verification. These listings are visibly unbadged, rank lower by default, and we recommend treating them with more caution — though "unverified" isn't the same as "fraudulent"; new accounts start here before climbing the ladder.
Does a high Trust Score guarantee a transaction will go smoothly?
It substantially reduces risk by filtering out the patterns most associated with fraud, but GETYOURHOME is not a party to any tenancy, sale or service agreement between users and can't guarantee any individual outcome. Use Safe-Meet, never pay to view, and use ordinary judgement even with a highly verified provider.
What happens to a provider's score if they stop being active?
Reviews and responsiveness signals decay over time, and proof-of-life re-verification lapses after 30 days, so an inactive account's score gradually declines rather than staying artificially frozen at its historical peak.
What can never happen — our structural guarantees
- No one can pay to raise a Trust Score or to rank higher in search results. There is no field in our database for paid placement, no invoice product that sells it, and no side channel that grants it — this is true by construction, not by policy.
- Staff cannot hand-edit a Trust Score. The only manual action possible is a documented fraud review, and every such review is permanently recorded in an audit log — who acted, when, and why.
- Listings scoring below 2.0 are automatically removed from default search results — no human decides this case by case, it's a standing rule applied uniformly.
- Three confirmed fraud reports against the same Workspace freeze that entire Workspace, not just the flagged Listing, because trust is evaluated at the level of who's operating, not which listing happened to be reported.
- Providers must re-prove each Listing is real every 30 days through proof-of-life photo re-verification; 7 days overdue triggers automatic suppression from search results until it's completed.
GETYOURHOME is a technology platform providing trust intelligence and connections — not an estate agent, not a party to any transaction between users, and never a custodian of your money without a named, licensed escrow partner. Methodology version 1.1; every change to how verification, scoring or security works is published on this page, with the version number updated, so this page is never quietly out of date with what the platform actually does.