Security

All traffic to our website and app is encrypted in transit (TLS). App data is held by our managed database provider and encrypted at rest.

Field records are kept only in our company Google Workspace, never on personal devices or personal cloud accounts. They have version history and are backed up weekly.

Access to enterprise records is on a need-to-know basis, through named individual accounts. Access is removed when someone's role changes or ends. Inside the app, what each person can see depends on their role. Our company Google accounts use two-step verification.

Each evidence item is kept with its source, how it was checked, and when. Corrections are dated and explained, and nothing is deleted silently, so anyone relying on a record can see how it was built. We never produce scores or ratings. A record holds evidence only.

Anyone who works with participant records, or has emergency access to them, must sign a confidentiality undertaking before they start. They must also be trained in our data-handling rules. Devices used for company work must be encrypted and screen-locked.

We use established providers for hosting, database and storage, email and documents, payments, and analytics. Each provider is checked before we use it, bound by a written agreement, and reviewed regularly. You can ask us for the current list.

When we suspect an incident, we contain it straight away. We record what happened and assess whether anyone accessed personal information without authorisation.

Where POPIA requires it, we notify the Information Regulator and the people affected as soon as reasonably possible. Where the GDPR or UK GDPR applies, we notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the incident. If we hold the information for an institution, we also tell that institution immediately.

Every incident is logged and reviewed, and what we learn feeds back into our controls.

Bhota Africa is not certified against ISO 27001 or SOC 2. Our controls are built around what POPIA requires. We will publish any certification when we achieve it.

If you find a security vulnerability, please email info@bhotaafrica.co.za with the subject line "URGENT: Security Report". Do not disclose it publicly. We will respond to you and fix it as soon as we can.