Starter
Your first SOC 2 or POPIA audit, without a consultant.
R1,499/month
incl. 15% VAT
- 1 framework
- 1 cloud account
- 20 users
- Public Trust Centre
- Audit chain on
Continuous compliance · Private beta · af-south-1
Your cloud changes every day.Your compliance should too.
SecureByte connects to AWS, Azure, and GCP in read-only mode, evaluates what it finds, collects the evidence, and maps it across 17 bundled frameworks. When something drifts, the affected controls are re-tested and your posture moves — without waiting for an audit to discover it.
30-day trial · No card required · POPIA Section 22 breach workflow included.
- Read-only cloud access
- 17 frameworks bundled
- af-south-1 residency
- Merkle-anchored audit chain
01Connect
- aws22 resource families
- azure17 resource families
- gcp15 resource families
read-only · cross-account role · rotating external id
02Evaluate
control engineFirst-party check runners, re-tested on a 6-hour cycle for critical controls75
03Map
controlsbundled catalogue852
frameworkscross-mapped17
04Retain
af-south-1Evidence sealed under S3 Object Lock, daily Merkle root anchored
The problem
Compliance is not a snapshot.
An audit certifies one moment. Your infrastructure moves the next morning. Everything between those two facts is a gap that nobody owns — and the longer the gap runs, the less the certificate describes.
Audit
Next audit
Meanwhile, in the estate
- Bucket policy relaxed for a one-off exportencryption control regresses
- MFA exception granted to a service accountaccess control regresses
- New region enabled for latencyresidency scope expands
- IAM role widened during an incidentleast-privilege control regresses
None of it is negligence. All of it is invisible until the next audit asks a question the evidence can no longer answer.
Replace the point with a loop
- 01Change
- 02Evaluate
- 03Evidence
- 04Impact
- 05Posture
The system
Six stations. One direction. Nothing in it waits for an audit.
Each station is a real subsystem with real ownership inside the platform. Change enters at the left and leaves as posture on the right — the machine does not stop between audits, because there is nothing in it that waits for one.
- 01Connect
A read-only role per cloud account. Reading your estate is all it can do until you separately opt in to remediation.
aws · azure · gcp · rotating external id
- 02Discover
Inventory the estate — compute, identity, storage, data, network, keys, logging.
22 aws · 17 azure · 15 gcp resource families
- 03Evaluate
Each control runs its own check and returns a verdict — 68 read the source system directly; 7 cover settings no API exposes and resolve against a signed attestation instead.
75 check runners · 68 automated · 7 attestation-backed
- 04Collect
The verdict and its supporting artefact are versioned and sealed as evidence.
sse-s3 · object lock compliance · retention
- 05Detect
A security-relevant configuration change re-tests the controls bound to that asset.
critical controls re-tested every 6 hours
- 06Maintain
Confirmed changes propagate to every framework holding an approved equivalent crosswalk. Weaker matches raise a task, never a claim.
daily merkle root anchored
Controls in catalogue
852
Across 17 bundled frameworks
Check runners
75
First-party, cloud + SaaS
Frameworks bundled
17
Security · privacy · AI · SA-gov
Default residency
af-south-1
AWS Cape Town
Answers to
- Security · CISO
- Real control posture across every account, daily.
- Compliance
- Evidence collected once, mapped across every obligation it crosswalks to.
- Platform · SRE
- Read-only access, webhooks, and a documented REST API.
- External auditors
- A chain they can verify without SecureByte online.
Cross-framework mapping
One control. Six obligations. Collected once.
Encryption at rest is not six pieces of work. It is one control whose evidence answers to six regulators — if something is holding the crosswalk. SecureByte ships that crosswalk, reviewed and typed, so the evidence you collect for one framework counts for the rest.
Collect once
ISO27001-A.8.24Use of Cryptography
evidence: bucket encryption state
source: aws · s3 · read-only
Satisfies
- POPIA-7.1Security Measuresequivalent
- PCI-3.5PAN is secured wherever it is storedequivalent
- NIST-PR.DS-01Data-at-Rest Protectionequivalent
- GDPR-32.1Security of Processingpartial
- SOC2-CC6.1Logical and Physical Access Controlspartial
- EUAIACT-15.3Cybersecurity for High-Risk AI Systemspartial
Equivalent — the two clauses ask the same question. Evidence carries across, and the target control can be attested on it.
Partial — the target is broader. The evidence contributes, but it does not close the control on its own, and SecureByte will not pretend it does.
Evidence
Evidence that is still true a year from now.
A screenshot in a shared drive proves that someone once saw something. A sealed, versioned, anchored record proves what was true, when it was true, and that nobody has touched it since — including us.
evidence · revision chainaf-south-1 · object lock
- 01Collected
The control runner fetches the artefact from the source system itself.
no screenshot uploads
- 02Sealed
A SHA-256 digest and an HMAC signature are computed before the object leaves the process.
sha-256 · hmac
- 03Stored
Written to object storage encrypted at rest, under a write-once retention lock.
sse-s3 · object lock compliance
- 04Linked
Each revision points at the one it supersedes, so the history is a chain, not a folder.
versioned · parent-linked
- 05Retained
Held for the retention period, exempt from purge under legal hold, anchored daily.
legal hold · merkle root
The daily Merkle root is committed to S3 Object Lock in COMPLIANCE mode. An auditor recomputes the path against that published root and verifies any historical entry without calling a SecureByte API — which is the point. Evidence you can only verify through the vendor that produced it is not evidence.
Change impact
One change. Every control it touches, the moment it's seen.
A configuration change is not an event in isolation — it is the first move in a chain that ends at your compliance posture. SecureByte walks that chain the moment the change is seen, and stops exactly where the change stops mattering.
- changed resource
- controls re-tested
- unaffected, not re-run
- 01Change
S3 bucket default encryption removed
Recorded as a configuration-history entry with the changed fields.
- 02Re-test
Controls bound to that asset
Only the controls mapped to the resource are re-evaluated — not the whole programme.
- 03Evidence
Prior revision superseded
The old record is retained and still verifiable; it is no longer current.
- 04Obligations
6 mapped crosswalks reconsidered
POPIA · PCI DSS · NIST CSF · GDPR · SOC 2 · EU AI Act.
- 05Posture
Recalculated, and someone is told
A control that flips writes to the audit chain and raises a notification.
The product
Stop abstracting. This is the surface.
Built from the same v2 primitives the dashboard itself renders — the score arc, the readiness ribbon, the metric tiles, the framework constellation. Not a screenshot, and not a marketing variant: any drift between this claim and the product shows up here as a visual diff.
app.securebyte.consulting · /dashboardv2026.06
Welcome back, Noxolo
Viewing asCISOYour security posture is steady across 4 frameworks — nothing urgent today.
Last scan 2 minutes ago
Where you stand
84
ALMOST THERE+2.4%A few items stand between you and audit-ready.
Eight controls failing across SOC 2 and NIST CSF. Clear those and your programme passes external review.
Framework readiness
ISO92%
ISO 27001POPIA88%
POPIASOC 276%
SOC 2 TSCNIST58%
NIST CSFWhat needs attention
Blocking
4
2 SOC 2 · 2 NIST
Stale evidence
12
Past 30-day window
Overdue tasks
3
2 due today
Audit-ready
2
ISO 27001 · POPIA
Framework constellation
Heavier edges = more shared controls.
4 frameworks active · 298 catalogue controlslast sync · 32 seconds ago
Coverage
Seventeen frameworks. Eight hundred and fifty-two controls.
One cross-mapped catalogue, not seventeen separate products — your plan sets how many you activate at once. The eighteenth framework is yours: custom catalogues are an Enterprise capability.
SecureByte852 controls · 17 frameworks
01Security posture
Enterprise procurement, cloud hardening, cardholder data
- CIS v8.1153
- NIST CSF 2.0106
- ISO 27001:202293
- PCI DSS v4.0.163
- SOC 2 (TSC 2017)61
02Privacy & access
Any SA organisation processing personal information
- GDPR46
- POPIA38
- PAIA22
03AI governance
Teams shipping AI features into regulated markets
- EU AI Act44
- ISO 42001:202338
04Resilience & IT
Continuity, disaster recovery, and IT service management
- COBIT 201940
- ITIL 434
- ISO 22301:201928
- NIST SP 800-34 R122
05SA governance
SA boards, JSE-listed entities, FSCA-regulated providers
- King IV — Corporate27
- King IV — IT20
- FAIS BN 194 of 201717
Reads from
- Cloud
- AWS — cross-account role
- Azure — service principal
- GCP — service account
- Identity
- Okta — SAML 2.0 · SCIM 2.0
- Entra ID — SAML 2.0 · SCIM 2.0
- OneLogin · JumpCloud — SCIM 2.0
- Google Workspace — OIDC
- Source & work
- GitHub — OAuth org install
- Jira — OAuth, two-way sync
- Ops & alerting
- Slack · Teams · Discord — webhook
- PagerDuty — Events API v2
Every connection is scoped and named. Cloud accounts are read-only by default; write access exists only for opt-in auto-remediation, which is operator-gated and dry-run first.
Compared to
What we shipped that the obvious alternatives didn't.
An honest positioning table — not every row is a SecureByte-only win. We've left in the cells where competitors match us, because pretending otherwise is the fastest way to lose a procurement review.
| Capability | SecureByte | Generalist GRC | Spreadsheet + scripts |
|---|---|---|---|
POPIA controls bundled Section 19 safeguards, Section 22 breach workflow, Information Officer registry — out of the box. | |||
Default data residency in af-south-1 Customer data hosted in AWS Cape Town, so SA workloads stay in-country by default. The sub-processor list names every exception. | |||
Cryptographically verifiable audit chain Daily Merkle root committed to S3 Object Lock. Auditor verifies without SecureByte being online. | |||
Per-control evidence runners 68 of 75 checks fetch their own evidence from the source system. The remaining 7 cover settings no API exposes and resolve against a signed attestation — they skip rather than fabricate a pass. No inert stubs. | |||
Multi-framework cross-mapping One control satisfies many obligations — collect SOC 2 CC6.1 evidence once, reuse it for ISO 27001 + PCI DSS + POPIA + CIS. | |||
AI-governance frameworks bundled ISO 42001 AI Management System and the EU AI Act ship as first-class, cross-mapped frameworks — not a future add-on. | |||
Public ZAR pricing No exchange-rate roulette, no minimum annual contract for self-serve tiers. | |||
Read-only cloud access (no write permissions) Cross-account IAM role + rotating external ID. We read your posture; changing your estate needs a separate, operator-gated opt-in. | |||
SAML SSO on Scale, SCIM on Enterprise SAML 2.0 single sign-on from the Scale tier; SCIM 2.0 provisioning keeps joiners and leavers in lockstep with Okta, Entra, OneLogin or JumpCloud at Enterprise. |
Honest disclosure: SecureByte is in private beta. The audit chain, control runners, framework bundles, SAML 2.0 / SCIM 2.0 provisioning, and Bring-Your-Own-Key for AI providers ship today. Customer-managed encryption keys for SecureByte's own evidence storage do not — evidence is encrypted with AES-256 server-side encryption under AWS-managed keys. Plan accordingly.
Trust
The answers, before the questionnaire.
Six statements we will put in writing. Nothing on this page describes a certification SecureByte holds — we support SOC 2 and ISO 27001, we are not yet certified against either, and the Trust Centre publishes exactly where we stand.
Default data residency
af-south-1
AWS Cape Town
Customer evidence, audit-chain entries, and tenant configuration stay in the region unless your organisation explicitly opts into cross-region replication. For a South African organisation under POPIA, that removes a cross-border-transfer conversation off the default procurement path. EU and US residency are available on Enterprise+ contracts.
- Read-only by default least privilege
- Cloud connections use a cross-account role bound by a per-tenant external ID that rotates. Auto-remediation is opt-in, operator-gated, and dry-run first.
- Tenant isolation in the database rls · forced
- PostgreSQL Row-Level Security is forced on tenant tables, so the application process itself cannot read across tenants — not only the API in front of it.
- Evidence written once sse-s3 · object lock
- Objects are stored with AES-256 server-side encryption and, where the bucket supports it, an Object Lock retention in COMPLIANCE mode. No overwrite, no delete.
- An audit chain you can check without us tamper-evident
- Every state change is appended to a per-tenant Merkle journal, with the daily root published under Object Lock. Verification recomputes the path — it does not call our API.
- SAML 2.0 and SCIM 2.0 enterprise sso
- Okta, Entra ID, OneLogin, JumpCloud. SCIM provisioning keeps joiners and leavers in lockstep with your directory; tokens are stored only as SHA-256 hashes.
- Legal hold and retention legal hold · ai byok
- Evidence and chain entries can be held against deletion for the duration of a disputed audit, breach, or litigation. Bring-Your-Own-Key for AI providers at Enterprise.
The full posture, including what we have not finished, lives on the Trust Centre and the Security page.
Common questions
The procurement questions, answered straight.
If you'd ask it in a security questionnaire, it should already be on this page. If something isn't here, write to hello@securebyte.co.za — we publish the question and the answer.
Where is my data hosted?
SecureByte runs in AWS Cape Town (af-south-1) by default. Customer evidence, audit-chain entries, and tenant configuration stay in the region unless your organisation explicitly opts into cross-region replication or enables the AI features whose providers are named on our sub-processor list. EU and US residency are available at Enterprise+ on request.
Who can read my data inside SecureByte?
Evidence objects are written to S3 with AES-256 server-side encryption and, where the bucket supports it, an Object Lock retention in COMPLIANCE mode. Cloud credentials and other sensitive fields are encrypted with AES-256-GCM under a per-tenant derived key, so one tenant's ciphertext cannot be decrypted with another tenant's key. The platform applies Row-Level Security in PostgreSQL so the application process itself cannot read across tenants. Operator access is scoped to break-glass incident response and requires SSO + 2FA, and every operator action in the platform is appended to the same Merkle-anchored audit chain your tenant uses — the same chain you and your auditor verify.
How is the audit chain verifiable?
Every state change is appended to a per-tenant Merkle-tree journal. We publish the daily root to S3 Object Lock with retention enforced at the bucket level. An auditor can verify any historical entry by recomputing the Merkle path against that day's published root — no SecureByte API call is required. Verification scripts are open and documented on the Security page.
What happens to my data if I cancel — or if SecureByte shuts down?
Self-serve tiers can cancel at any time from the billing portal. We export your evidence, controls, and audit-chain entries as a signed ZIP at cancellation; you keep the cryptographic proofs even after the tenant is decommissioned. At Enterprise+ we sign a formal source-code + data escrow agreement.
Are you SOC 2 / ISO 27001 certified yourselves?
Not yet. We are running SecureByte against its own controls — a SOC 2 Type I attestation is targeted within the first 12 months of GA, ISO 27001 within 24. We publish our current control posture on the public Trust Centre so you can see the same dashboard our auditors will. We'd rather ship a real audit chain in beta than a polished badge without one.
What write access does SecureByte need to my cloud?
None on the standard plan. Cloud connections use a cross-account IAM role with read-only managed policies (or the Azure / GCP equivalents), bound by a per-tenant external ID that rotates every 90 days. Auto-remediation is opt-in, gated by an operator-side environment flag, and writes are dry-run by default in the UI — so a curious operator can see what a fix would do before any cloud mutation happens.
How do you price as my org grows?
Self-serve tiers are flat-rate in ZAR — Starter R1,499/month, Foundation R3,499/month, Scale R8,999/month. Annual prepay saves 15%. Enterprise and Enterprise+ are sold on annual contracts, tailored to your estate — sized to user count, cloud accounts, and add-on features (Bring-Your-Own-Key for AI providers, dedicated tenancy, custom frameworks) — talk to sales for pricing. We don't do per-control or per-evidence-item billing.
What integrations are on the roadmap?
GitLab, Bitbucket, Linear, Asana, ServiceNow, Wiz, Snyk, Tenable, CrowdStrike, and SentinelOne — all targeted at the audit-package generation flow rather than at point-tool feature parity. We'd rather integrate deeply with five tools than badly with fifty. If you need a specific integration to commit, talk to sales and we'll fold it into the roadmap.
Pricing
Three plans you can start today. Annual saves 15%.
Starter is the wedge — your first audit, R1,499/month. Foundation is the SA-SME workhorse. Scale handles multi-cloud reality. All three come with a 30-day trial — no card required.
Foundation
Become audit-ready on one framework, one cloud.
R3,499/month
incl. 15% VAT
- 1 framework
- 1 cloud account
- 50 users
- Quarterly access reviews
- OIDC SSO + 1,000 AI credits
Scale
Multi-framework, multi-cloud, with a real auditor portal.
R8,999/month
incl. 15% VAT
- Up to 3 frameworks
- 5 cloud accounts
- SAML 2.0 SSO
- Custom-domain Trust Centre
- 5,000 AI credits
Public ZAR pricing for Starter, Foundation and Scale. POPIA-native at every tier. 30-day trial, no card required.
See the full pricingStay audit-ready.Your cloud is already changing.
Tell us about your estate, connect one AWS account in read-only mode, and we run a subset of the CIS v8.1 and POPIA checks. The report lands within one business day. No tenant, no card, data purged after 30 days.
Not ready to connect anything? Join the early-access list and we'll reach out as onboarding opens.