Collecting NRCs at move in
Landlords holding tenant details
You are handing over identity and payment information, and you want to know exactly what happens to it.
Notes for Zambian landlords
No. 10 · Tenant NRCs, payment proof and your privacy
Updated September 2026
No. 10 · Security and privacy
What happens to a tenant’s NRC and your payment proof
Asking a tenant for an NRC number, or sending a payment screenshot that may show other transactions, means trusting a system you cannot see inside. Most software answers that with a privacy policy nobody reads. This note is the specific answer instead.
In short
- NRC and passport numbers encrypted, with the key kept apart
- Location data stripped from photos before they are stored
- Agents limited to their properties by the database itself
- Admin access needs more than a password
02 · Side by side
The same details, two ways
In a chat or a spreadsheet
- An NRC number typed into a shared sheet
- A screenshot that still records where it was taken
- An agent who can see everything you can
- One password between anyone and everything
In Tezeka
- The NRC is encrypted before it is stored
- Location data removed before storage
- An agent sees only the properties you assign
- Admin access needs an approved device and a second factor
A privacy policy does not answer the real worry
The worry is not abstract. It is “if this is hacked, is it my tenant’s NRC that leaks?” or “can the agent I hired see my other properties?” A general privacy policy answers neither. What answers them is what is built into the system before anyone asks.
04 · How it works
The safeguards, one step at a time
These are not promises. Each is a specific mechanism, answering one part of the worry above.
- When entered
NRC and passport numbers are encrypted with AES256 in GCM mode, before they are written anywhere.
- When uploaded
Photos lose their location data, including GPS, before they are stored.
- On every query
Agents are limited to their properties by row level security in the database, not just by the screen.
- At sign in
Sensitive actions are rate limited to slow down anyone trying to guess.
- On every webhook
Messages from providers are signature checked, and a replayed request is rejected.
- For admins
Admin access needs an approved device and a second factor, never a password alone.
What Tezeka does, and does not do, with your money
Tezeka never receives or holds your rent. Tenants pay you directly, exactly as they do now. A payment screenshot is evidence you submit for checking, not a transaction that passes through Tezeka. The only money that goes through a payment provider is your own subscription to Tezeka, which is entirely separate from your rental income.
06 · Who this is for
Three people we had in mind
Living abroad, with an agent in Lusaka
Owners who delegate
You want your agent to see only what they need, enforced by the system rather than by trust alone.
An agent with several owners
Agents reassuring owners
You can point to how access is built: an owner’s other properties and billing are out of your view by design.
07 · What changes
What this means in practice
- i
A tenant’s NRC is never stored in plain text
- ii
An agent cannot reach another owner’s tenants
- iii
A screenshot cannot give away where it was taken
- iv
Nobody runs the system on a password alone
No. 0001
- Date
- Today
- Received from
- You
- For
- 1 unit
- Amount
- K99 a month
Counterfoil. Keep for your records
Start here
Start with the property you have
Solo is K99 a month for 1 unit. Your tenants keep paying you directly by MoMo, Airtel Money or bank transfer. Tezeka never touches your rent.
Does Tezeka sell or share tenant data?
No. Tenant and payment data is used to run the service for the landlord it belongs to. It is not sold or shared with third parties for other purposes.
Can an agent see a landlord’s other properties or billing?
No. Agent access is limited to assigned properties, and billing and plan controls do not appear in agent pages at all.
Is my tenant’s NRC number encrypted?
Yes. NRC and passport numbers are encrypted with AES256 before storage, and the encryption key is kept apart from the data.
What happens to payment screenshots after they are checked?
They are stored with their metadata, including GPS location, removed first, so the file cannot give away where it was taken.
How is admin access to Tezeka’s own systems protected?
Each admin browser has to be approved with a code sent by email, and every admin session needs a second factor as well as a password. A new approved device alerts every admin. Staff can only open your account with a one time code you give them, and the visit ends on its own.
What happens to my data if I cancel?
Retention follows Tezeka’s privacy policy. In general, records are not deleted outright on a downgrade or a pause. The privacy policy has the full detail.