Answered before you send the form.

Where is it hosted?

In South Africa, on Vultr, with backups held in a second South African region. Uploaded files are stored separately, with Amazon Web Services in Cape Town. We will name both Vultr regions in writing when you ask. If your own rules require hosting elsewhere, raise it before you sign and we will tell you plainly whether we can.

Is data encrypted in transit?

Yes, and the database connection is the strict case: the application refuses any connection that is not on loopback unless the certificate verifies. Our own CI tunnels through loopback rather than weaken that rule.

How are customers isolated from one another?

By row-level security policies in Postgres, not by a WHERE clause in application code that somebody could forget. Automated tests attempt cross-customer reads on every build and fail it if one succeeds.

How do people authenticate? Is single sign-on supported?

Through your own identity provider over OpenID Connect with PKCE, with a documented Microsoft Entra setup, or by a one-time emailed link. A session is issued for one workspace and refused on any other, checked on every request rather than only at sign-in.

What is your password policy?

There are no passwords. Nothing is hashed, rotated, leaked or reset, because nothing is stored.

How is access controlled inside a customer’s workspace?

Your organisation defines its own roles and who holds them, and approvals follow those roles. Your administrators manage this themselves, from inside your workspace.

What is logged, and can the log be altered?

Every action is a row in an append-only, hash-chained trail, one chain per customer. Updates and deletions are refused by the database. A proof suite breaks a chain deliberately and demonstrates the break is detected. The end of the chain is emailed weekly to your own managers, and you can download the whole trail and verify it on a page that runs on your machine.

Do your staff access customer data?

Only for support, and when they do it is written to that customer’s own trail, not to ours.

How often do you back up, and how long do you keep backups?

Nightly, off the database instance and off the cluster. Fourteen are kept, then rotated out.

Do you test restores?

Not on a schedule, and we will not pretend otherwise. The procedure exists and the runbook describes it, but there is no record of it having been run and verified. It is an ordinary gap at our size and a cheap one to close.

Have you had a penetration test?

No. Not by anyone, ever. At our size no buyer in our price range has required one, and when that changes we will commission one rather than claim one.

What is your secure development practice?

Every claim we publish is covered by a suite that runs on each build and fails it. Isolation, authentication, the audit chain, billing lapse behaviour and each service’s own process are all proven that way rather than asserted.

Who are your sub-processors?

Six, listed in full below, with what each one sees. The product itself carries no analytics and no error reporting of any kind.

Where does our data live, and what leaves the country?

Business records stay in South Africa. Two things leave: email notifications, which carry a recipient’s name, address and the text of the notification, and the billing details of a paying customer. Nothing else.

Can we export our data?

Yes. Records stay readable and exportable, and the whole audit trail downloads for independent verification. If a payment is late, paid services go read-only while records stay readable. Deletion only follows cancelling the whole workspace.

Can we have our data deleted?

Yes. A workspace is deleted 30 days after it is cancelled: its people, records, uploaded files with every stored version, and its audit trail. Every administrator is told the date when it is cancelled and reminded seven days and one day before, and subscribing again stops it. To have it deleted sooner, ask us. Invoices and billing records are kept for five years, as tax law requires, holding nothing of the workspace’s contents. Deleted data leaves our backups as they expire.

How would we be told about a breach?

Affected customers are told within 72 hours of a compromise being confirmed. The Information Regulator is told as soon as reasonably possible, as POPIA section 22 requires. Confirmed, not discovered: working out whether an alert is a real compromise takes hours, and 72 is a commitment we can keep because the clock starts when we know.

What is your PCI scope?

None. Paddle is merchant of record: card details are entered into Paddle’s own checkout and never reach our systems, so we are out of PCI scope entirely.

Do you hold ISO 27001 or SOC 2?

Neither, and neither is in progress. At our size none is expected, and we would rather say so than let a silence read as evasion.

What do you not publish?

Encryption at rest for the database, and our patching cadence. Both are real, neither has been verified to the standard we hold the rest of this page to, so neither is claimed here. Uploaded files are the exception, and how they are stored is set out below. Ask and you get the answer in writing, with the evidence.

Hosting is South Africa wherever you are. Somewhere else is a conversation before a signature, not a switch. An organisation outside these three sees the South African answer, which is the one that describes where your records actually sit.