Skip to main content
Skip to main content

Security

How we secure the platform.

A compliance product has to hold itself to a higher standard than its customers. Every control listed below is implemented and verifiable. The few items still on the roadmap are labelled honestly — no "coming soon" sleight of hand.

Controls

What's implemented today.

Every group below corresponds to a question we routinely see on procurement questionnaires.

Data residency & encryption

  • Customer data hosted in AWS af-south-1

    Live

    Cape Town region by default. Enterprise+ may opt into eu-west-1 or us-east-1.

  • Encryption at rest — AES-256

    Live

    Evidence objects use S3 server-side encryption under AWS-managed keys. Sensitive fields use AES-256-GCM under a per-tenant derived key.

  • Encryption in transit — TLS 1.3

    Live

    All API and dashboard traffic. HTTP requests redirect to HTTPS at the edge.

Identity & access

  • OIDC SSO for every tier (Google + Microsoft)

    Live

    Default sign-in for Foundation users. No password-based fallback for SSO orgs.

  • SAML 2.0 SSO at Scale and above

    Live

    Okta, Azure AD, OneLogin, JumpCloud. SP-initiated and IdP-initiated flows.

  • SCIM 2.0 provisioning at Enterprise

    Live

    Joiner-mover-leaver lifecycle stays in lockstep with your IdP.

  • Scoped RBAC at Enterprise

    Live

    Per-business-unit, per-cloud-account access scoping.

Application controls

  • CSRF protection

    Live

    Double-submit cookie pattern + Origin/Referer validation on all state-changing endpoints.

  • Per-IP and per-account rate limits

    Live

    Tuned per route — login, registration, password reset, marketing-form ingest.

  • Row-Level Security in Postgres

    Live

    Tenant boundary enforced at the database layer; the application is defence in depth.

  • AI-output attestation

    Live

    Every AI-generated artefact is labelled and requires human attestation before it appears as evidence.

Audit chain & evidence integrity

  • Append-only audit log

    Live

    Every state change is recorded. The audit log table is INSERT-only at the database role level.

  • Merkle-anchored daily root

    Live

    Daily root committed to S3 Object Lock — tamper-evident and externally verifiable.

  • Legal hold

    Live

    Per-customer legal hold prevents deletion of evidence under disputed audits or investigations.

Payments & PII handling

  • PayFast handles all card data — PCI DSS Level 1

    Live

    No card numbers ever touch SecureByte infrastructure. We store an encrypted recurring-billing token only.

  • POPIA s.18 notice on data collection

    Live

    Marketing form ingest captures only what is needed for follow-up; full notice in /legal/privacy.

  • POPIA s.22 breach workflow

    Live

    Regulator-ready breach notification template available at Enterprise+ tier.

Backups, DR, and continuity

  • Postgres point-in-time recovery

    Live

    Continuous WAL archival; restore to any second within the retention window.

  • Cross-AZ replication

    Live

    Production data replicated synchronously across af-south-1 availability zones.

  • SOC 2 Type II report (in scope)

    Roadmap

    Currently running our own controls through SecureByte; a formal auditor engagement is planned and in our pipeline.

  • ISO 27001 certification (in scope)

    Roadmap

    Same plan as above. We are dogfooding the platform — when it is audit-ready for us, it is audit-ready for you.

Report a vulnerability

See something? Send us a structured report.

We do not currently run a public bug-bounty programme. We do accept responsible disclosure via email at security@securebyte.co.za. A founder will respond within 48 hours.

For high-severity issues affecting customer data, you can use our PGP key (fingerprint published on /trust). We commit to fixing critical issues within 7 days of confirmed report and coordinated public disclosure no earlier than 90 days after fix availability.

Want the full security-questionnaire pack?

SIG-Lite + CAIQ-style answers, MSA, DPA, sub-processor list — all on hand. Ask in your first email.