Privacy & POPIA notice

SecureByte is a South African compliance and governance, risk & compliance (GRC) automation platform operated by SecureByte Consulting (Pty) Ltd, a company registered in the Republic of South Africa. Our public website is securebyte.co.za and the application runs at app.securebyte.consulting.

SecureByte Consulting (Pty) Ltd is the responsible party for the personal information collected through our website, marketing forms, and the operation of your SecureByte account. When you use the SecureByte service to process information about your own personnel, customers, or other data subjects, you are the responsible party and SecureByte acts as the operator on your behalf; that relationship is governed by our Data Processing Agreement.

Our POPIA Information Officer can be reached at privacy@securebyte.co.za.

The categories below describe information for which SecureByte is the responsible party — that is, information about you as a visitor, prospect, or account holder. Information you upload intothe platform about your own data subjects (“Customer Data”) is processed under the Data Processing Agreement and is summarised separately at the end of this section.

• Account & identity. First name, last name, work email, job title, phone number, profile avatar, assigned role, and organisation membership. Passwords are stored only as Argon2id hashes — never in plain text.
• Organisation details. Organisation name, industry, size, country, and — where you complete your POPIA setup — your nominated Information Officer and deputy details, company registration number, and registered address.
• Marketing & lead-form submissions. Fields you complete on /snapshot or /contact — full name, work email, company, phone (optional), company size, cloud provider, an optional AWS role reference, your message, plan interest, and the marketing campaign/referrer (UTM) parameters in your link. We also record the IP address and browser user agent of the submission to filter spam.
• Trust Center access requests.Where a third party requests access to a customer’s Trust Center: requester name, email, company, role, and the stated purpose.
• Authentication & security metadata. Session and refresh-token records, IP address, user agent, last-activity and last-login timestamps, and failed-login / account-lockout counters. Used to keep your account secure and to detect suspicious sign-in attempts.
• Audit & activity logs. A tamper-evident record of significant actions taken in your account — the acting user, action, affected resource, timestamp, outcome, IP address, and user agent.
• Billing details. Subscription tier and status, billing cycle, invoice history, line items, company name, VAT number, and postal billing address, plus a PayFast subscription/payment identifier. Payment card details are processed entirely by PayFast and are never received or stored by SecureByte.
• Support correspondence. Emails, in-app messages, and screenshots you send to support@securebyte.co.za.

Customer Data (where SecureByte is the operator). Depending on the modules you enable, the platform stores information about your data subjects on your behalf — for example personnel records (name, email, job title, department, manager, employment type, training and device-posture data), and privacy-programme records such as consent records, data-subject requests (including any identity document you upload to verify a requester), breach records, records of processing activities (ROPA), data-flow maps, and data-protection impact assessments. SecureByte processes this information only to provide the service to you and under your instructions.

Some platform features may involve special personal information as defined in POPIA (section 26) or special categories under the GDPR. Examples include background-check outcomes (such as criminal, credit, or identity checks) stored in the personnel module, identity documents uploaded to verify a data-subject request, and breach records that may reference sensitive categories of affected data.

Where SecureByte is the responsible party, we do not collect special personal information about you in the ordinary course. Where this information forms part of Customer Data, you remain the responsible party and are responsible for establishing a lawful basis for its processing; SecureByte applies heightened access controls and encryption to it.

We process personal information to:

• provide, operate, and secure the SecureByte service and your account;
• respond to enquiries and demo requests you submit through our marketing forms;
• bill subscriptions, issue tax invoices, and manage renewals and cancellations;
• communicate with you about your account, security, and service changes;
• detect, investigate, and prevent fraud, abuse, and security incidents;
• generate AI-assisted suggestions where you have enabled AI features (see the AI section below); and
• comply with our own legal, tax, and regulatory obligations.

We do not sell personal information, and we do not use it for third-party advertising.

Under POPIA, we rely on the following grounds to lawfully process your personal information:

• Performance of a contract. For account information, billing, and most service delivery.
• Legitimate interest. For marketing-form responses, fraud and abuse detection, security monitoring, and service-improvement analytics.
• Consent. For optional newsletter sign-ups or other communications you explicitly subscribe to.
• Legal obligation. For records we must retain, such as tax and accounting records under South African Revenue Service requirements.

For EU/UK data subjects, the GDPR-equivalent grounds (Art. 6(1)(b), 6(1)(f), 6(1)(a), 6(1)(c)) apply.

We share personal information only with the third-party operators (“sub-processors”) that are necessary to deliver the service. The current list — which includes our hosting provider (AWS), payment gateway (PayFast), CDN/WAF (Cloudflare), email delivery, observability (Datadog and Sentry), and, where enabled, AI providers — is maintained at /legal/sub-processors. Each sub-processor is bound by a data-processing agreement with SecureByte at least as protective as this notice.

Separately, the platform can connect to third-party systems that you choose to integrate (such as your cloud accounts, identity provider, or collaboration tools). Those are governed by your own agreements with those providers, not by SecureByte. We may also disclose personal information where required by law, court order, or to protect our rights, users, or the security of the service.

Personal information processed under the SecureByte service is hosted in South Africa (AWS Cape Town, af-south-1) by default. A limited set of operational sub-processors — notably our observability tooling (Datadog, Sentry) and, where enabled, AI providers — may process scrubbed telemetry or submitted content outside South Africa (typically the United States or EU).

Where personal information is transferred outside South Africa, we ensure the transfer is permitted under POPIA Section 72 — including by relying on the recipient being subject to a law or binding agreement that provides an adequate level of protection, by using contracts such as Standard Contractual Clauses for GDPR purposes, or by obtaining your consent. Enterprise and Enterprise+ customers can additionally elect EU or US data residency for the core platform.

We retain personal information only as long as necessary for the purpose it was collected or as required by law. Indicative retention periods include:

• Account information — for the life of the subscription plus 90 days.
• Tax, accounting, and invoice records — at least 5 years, as required by the South African Revenue Service and the Value-Added Tax Act.
• Marketing & lead-form submissions — 24 months.
• Refresh-token and session records — up to 30 days.
• Notifications — up to 90 days.
• Audit logs and data-subject-request records — retained on a multi-year basis (typically up to 7 years) to preserve a defensible compliance history.
• Evidence and breach records — retained on a long-term basis (up to 10 years) consistent with audit and regulatory expectations.

Retention can be extended where a legal hold is in place or where a longer period is required by law, and may be shorter on lower subscription tiers. Records subject to a legal hold are preserved until the hold is released.

We apply the technical and organisational safeguards described on our Security page and in our Data Processing Agreement. Highlights include:

• Encryption at rest. AES-256-GCM across multiple layers, including client-side (zero-knowledge) encryption of uploaded evidence, server-side field encryption with per-tenant key separation, and AES-256 server-side encryption of object storage.
• Encryption in transit. TLS 1.2/1.3 with HTTP Strict Transport Security.
• Strong credential handling. Argon2id password hashing and encrypted storage of two-factor secrets.
• Tenant isolation.Postgres row-level security is force-enabled on tenant tables so one organisation’s data cannot be read by another.
• Tamper-evident audit logging. Append-only, HMAC hash-chained audit logs with database-enforced immutability and periodic write-once (WORM) integrity anchoring.
• Access control. Role-based access control with separation-of-duty safeguards, optional single sign-on (SAML/OIDC) and SCIM provisioning, two-factor authentication, and per-organisation IP allowlisting.
• Platform hardening. Strict security headers and Content-Security-Policy, rate limiting, per-tenant derived encryption keys, and key-rotation tooling. Customer-managed encryption keys for SecureByte-held data are not currently available.
• Payment security.Card data is handled exclusively by PayFast; it never reaches SecureByte’s systems.

Under POPIA and equivalent foreign laws you have the right to:

• Request a copy of the personal information we hold about you.
• Request correction of inaccurate or out-of-date personal information.
• Request deletion of personal information where it is no longer necessary for the purpose for which it was collected.
• Object to the processing of personal information on legitimate-interest grounds.
• Withdraw consent at any time, where processing is based on consent.
• Lodge a complaint with the Information Regulator (South Africa) at inforegulator.org.za (POPIAComplaints@inforegulator.org.za).

Send rights requests to privacy@securebyte.co.za. We respond within 30 days. If your request relates to data held by a SecureByte customer (Customer Data), we will refer you to that customer as the responsible party and assist them in responding.

Some features can use artificial intelligence to draft control narratives, suggest evidence, or recommend remediation steps. AI features are optional and are only invoked for the specific content you submit to them. When they are enabled, the relevant content is processed by the AI sub-processors listed on our sub-processors page; Enterprise customers can route AI through their own provider key (BYOK).

AI output is advisory and is intended to support — not replace — human judgement. We do not use it to make decisions that produce legal effects about you without human involvement, and we do not use your data to train third-party foundation models.

The SecureByte application uses strictly-necessary cookies for authentication, CSRF protection, and session continuity, plus an optional first-party telemetry cookie used by our in-app performance monitoring. We do not use third-party advertising, social-media, or cross-site tracking cookies. Full details — including each cookie’s purpose and lifetime — are in our Cookie Policy.

Material changes to this notice are communicated by email to active customers and surfaced on the dashboard. The “Last updated” date at the top of this page changes when the notice changes; we keep an archived version available on request.

The POPIA Information Officer for SecureByte Consulting (Pty) Ltd is reachable at privacy@securebyte.co.za.