Data Processing Agreement

The Customer is the responsible party (POPIA) and the data controller (GDPR, where applicable) for personal information processed through the SecureByte service. SecureByte Consulting (Pty) Ltd (“SecureByte”) is the operator (POPIA) and data processor (GDPR) acting on the Customer’s documented instructions. This DPA applies whenever SecureByte processes personal information contained in Customer Data.

SecureByte processes personal information solely to provide the SecureByte service — control evaluation, evidence collection, audit reporting, risk and vendor management, the POPIA/GDPR privacy module, and related platform functionality the Customer has subscribed to.

• Subject matter & duration. Processing continues for the term of the subscription and the limited wind-down period described in the deletion section below.
• Nature & purpose. Hosting, storage, organisation, evaluation, display, and export of Customer Data to deliver the Service.
• Categories of data subjects.Typically the Customer’s personnel and contractors, its administrators and platform users, its own customers or other data subjects recorded in the privacy module, external auditors, and vendor contacts.
• Categories of personal information. Contact and identity details, job and organisational details, authentication and device metadata, and — depending on the modules the Customer enables — privacy-programme records and any special personal information the Customer chooses to upload (for example background-check outcomes or identity documents).

The precise categories and types of personal information processed depend on what the Customer connects to and uploads into the platform, which is within the Customer’s control.

The Customer’s instructions are reflected in this DPA, the Master Services Agreement (where applicable), and the configuration settings exposed in the platform itself. Additional instructions must be in writing. SecureByte will not process personal information for any purpose other than as instructed, and will inform the Customer if, in its opinion, an instruction infringes applicable data-protection law.

SecureByte applies the technical and organisational measures summarised in the next section and described more fully on our Security page and in the security-questionnaire pack available on request. These measures are designed to ensure a level of security appropriate to the risk, consistent with POPIA section 19 and GDPR Article 32.

The measures SecureByte maintains include:

• Encryption. AES-256-GCM encryption at rest (including client-side, zero-knowledge encryption of uploaded evidence and per-tenant key separation for server-side field encryption) and TLS 1.2/1.3 in transit with HSTS.
• Tenant isolation.Force-enabled Postgres row-level security scoping each organisation’s data, with additional cryptographic separation between tenants.
• Access control. Role-based access control with separation-of-duty safeguards, least-privilege staff access, two-factor authentication, optional customer SSO (SAML/OIDC) and SCIM provisioning, and per-organisation IP allowlisting.
• Credential protection. Argon2id password hashing; encryption of two-factor secrets and stored integration credentials.
• Audit & integrity. Append-only, HMAC hash-chained audit logs with database-enforced immutability and write-once (WORM) integrity anchoring.
• Operational controls. Strict security headers and Content-Security-Policy, rate limiting, per-tenant derived encryption keys with key-rotation tooling, malware-scanning of uploads where configured, and continuous monitoring. Customer-managed encryption keys for SecureByte-held data are not currently available; the Bring-Your-Own-Key option at Enterprise applies to AI provider credentials only.

Access to Customer personal information is limited to SecureByte personnel who need it to perform their duties. All personnel are bound by written confidentiality obligations that survive the end of their engagement with SecureByte.

SecureByte engages the sub-processors listed at /legal/sub-processors. Each is contractually bound to data-protection obligations at least as protective as those in this DPA. SecureByte will give the Customer at least 30 days’ notice before adding or replacing a sub-processor. The Customer may object on reasonable grounds; if the objection cannot be resolved, the Customer may terminate the Service for that portion that depends on the sub-processor without penalty.

Personal information is hosted in AWS Cape Town (af-south-1) by default. Where a cross-border transfer to a sub-processor is necessary — for example to our observability or AI tooling — SecureByte ensures the transfer is permitted under POPIA Section 72 and, where the destination is outside the European Economic Area for GDPR purposes, under GDPR Chapter V (Standard Contractual Clauses where applicable). Enterprise and Enterprise+ customers may elect EU or US residency for the core platform.

SecureByte will provide the Customer with reasonable assistance to respond to data-subject access, rectification, deletion, portability, and objection requests received by the Customer, including through the data-subject-request tooling in the platform. Where SecureByte receives a data-subject request directly, it will forward the request to the Customer without undue delay unless prohibited by law.

SecureByte will notify the Customer of any personal-information breach affecting Customer Data without undue delay and in any event within 48 hours of becoming aware of the breach. Notification will include the nature of the breach, the categories and approximate volume of affected records, the likely consequences, and the measures taken or proposed. SecureByte will reasonably assist the Customer to satisfy its own POPIA Section 22 / GDPR Art. 33–34 notification obligations.

SecureByte will make available the information necessary to demonstrate compliance with this DPA, including security-control documentation, the sub-processor list, and — when available — independent third-party audit reports. Customers at Enterprise and Enterprise+ tiers may, on reasonable notice and at their own cost, conduct audits of SecureByte’s relevant facilities and records as detailed in their Master Services Agreement.

On termination of the Service, the Customer may export Customer Data using the built-in export tools for a period of 30 days. SecureByte will then delete Customer Data within 90 days after termination unless the Customer has activated a legal hold or unless a legal obligation requires retention. Certain records — notably tamper-evident audit logs and financial records — are retained for the periods required by law and our integrity model, after which they are deleted in the ordinary course.

Liability under this DPA is capped at the limits set in the Master Services Agreement (or, where no MSA has been signed, in the SecureByte Terms of Service). Nothing in this DPA excludes liability that cannot be excluded under applicable law.

SecureByte may update this DPA from time to time to reflect changes in applicable law or in our security posture. Material changes are communicated to active customers in advance. Where a change reduces a customer’s rights and the customer objects, the customer may terminate the affected services without penalty.