When the system has to hold up in court.
TrendPro EMS is a command, capture and parallel-tally platform we built and operate. The interesting part is not the subject — it is the constraints: field data that must survive no signal, records that must be tamper-evident, tenants that must never see each other, and a load that arrives all at once.
Designed, built and run by TrendPro.
Agent registry and deployment, coverage and readiness heatmaps, results-form capture with a chain of custody, a live parallel tally showing projected, confirmed and official figures side by side, incident reporting, legal evidence export, and an optional performance-linked payment tranche for field agents. Bilingual English and Swahili.
It is also a product-design case: discovery, UX for a high-stress operations room, and a field app for non-technical users working under time pressure. See our product design service.
TrendPro EMS is non-partisan infrastructure with no public results feed. We name no campaign, candidate, party or client — and this page is about engineering, not politics.
Design capacity, not demonstrated load. The system is designed for national scale — 46,229 polling stations, 47 counties and roughly 277,000 agents online at peak, all landing in a nine-hour window. Those are design targets. Security and recovery controls described below have been verified in dry runs.
The constraint, the decision, and what it means for your project.
Offline-first field capture
Missing GPS or signal warns and queues locally rather than blocking. A legitimate field action is never hard-stopped.
Field apps that work on Kenyan networks — logistics, agriculture, inspections, utilities, field sales.
Tamper-evident chain of custody
On-device SHA-256 hash before upload, hardware GPS and clock, a server re-hash on arrival, and append-only records: corrections add versions, nothing is overwritten. Records replicate to a write-once (WORM) audit bucket.
Evidence-grade audit trails for regulators, courts, banks and government.
Hard multi-tenant isolation
Schema-per-tenant on PostgreSQL, enforced server-side, so two tenants’ data never render in one list.
Multi-tenant SaaS and shared platforms where a cross-tenant leak is unacceptable.
Burst load in a fixed window
Every field site closes and uploads at once, inside a nine-hour night, at national scale.
Systems that must survive deadline peaks: payroll runs, tax filing deadlines, results days, month-end close.
Real-time aggregation and reconciliation
A live, socket-driven operations room rolls figures up three levels and reconciles an internal tally against official figures, with a variance view.
Live operations dashboards and reconciliation engines.
Authentication for mixed-capability users
TOTP multi-factor authentication for admins and managers, SMS one-time codes for field agents, and device attestation through Play Integrity.
Systems serving office staff and low-connectivity field users, with device fraud controls.
Payments without holding client funds
Performance tranches release automatically on verification. Funds stay in the client’s own account with the payment provider, and every disbursement is a signed line item.
Payment and disbursement integrations without TrendPro touching client float.
Privacy and data-protection engineering
Built to the Data Protection Act 2019, with ODPC registration as controller and processor, a DPIA on file, an appointed DPO, recorded consent, and selfies used for human verification only — no face-matching.
Privacy by design for any system that holds Kenyan personal data.
Resilience and data residency
AWS af-south-1 (Cape Town), Multi-AZ, TLS 1.3, encryption at rest, and disaster recovery with a recovery point of 5 minutes or less and a recovery time of 30 minutes or less.
Data residency and continuity commitments that can actually be documented.
Need a system with constraints like these?
Bespoke systems, field applications and evidence-grade audit trails are what our custom software work is for.