Security

Where your data is stored and processed

Records and documents are stored on Amazon Web Services in the Cape Town (af-south-1) region. Some processing by named service providers happens outside South Africa:

• Render runs our application servers in Frankfurt, Germany.
• Anthropic writes assistant answers and reads uploaded documents and payroll files. Voyage AI powers search across the law library and your own policies. OpenAI transcribes hearing recordings. These are US companies, and their processing may happen in the United States.
• Meta delivers WhatsApp payslips and Resend sends email from the platform. Both process outside South Africa.

Where personal information is processed outside South Africa, we transfer it only on the conditions set by section 72 of POPIA. See our Data Processing Agreement.

Encryption

• In transit: connections to Compliance Radar use HTTPS (TLS).
• At rest: South African ID numbers and payroll connection credentials are encrypted with AES-256-GCM. Documents are stored in Cape Town. Files in our object storage are encrypted and open through links that expire after 15 minutes.
• Passwords: hashed with bcrypt (cost factor 12) — never stored in plain text.

Access control & tenant separation

• The server, not the browser, decides which company a request belongs to, and records and files are kept separate per company.
• Roles (Company Admin, Manager and Viewer) limit what each user can see and do within their company.
• Sessions expire automatically, and the API is rate-limited to prevent abuse.

Activity log

Sign-ins, failed sign-ins, changes, deletions, downloads, exports and settings changes are recorded in an activity log with the user, the time and the IP address. This gives you a reviewable record of who did what, and when.

Deleted records

Staff, their credentials, vehicles, staff reviews and hearing recordings are marked as deleted rather than erased straight away, which protects you against accidental deletion.

Responsible disclosure

If you believe you've found a security vulnerability, please email [email protected] with the details. We'll acknowledge your report, investigate promptly, and keep you informed. Please give us a reasonable opportunity to remediate before any public disclosure.

Breach notification

If we have reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, we will notify the affected customer immediately, as section 21 of POPIA requires of an operator, and give it the information it needs to notify the Information Regulator and the people affected under section 22. For personal information we hold as responsible party, such as account details, we notify the Information Regulator and the people affected ourselves, as soon as reasonably possible.