Security & reliability
Security that operators can trust.
Your customer data, payment events, and message history sit on infrastructure built for high operational security and reliability.
01How your data is protected
Built with security-first engineering.
POPIA-aligned, encrypted in transit and sensitive credentials encrypted at rest, with primary hosting in South Africa — the same infrastructure our own dashboard runs on.
Primary platform data is hosted in South Africa. Where specific integrations require approved international processors (such as WhatsApp or AI inference), contractual and data-protection safeguards apply.
TLS 1.3 in transit; pgcrypto AES-GCM at rest for sensitive credentials and banking details.
Supabase Auth with role-based access — Operator and Main Admin, with per-section permissions.
Row-level security on all 40+ public tables, so a tenant only ever sees its own data.
HMAC-SHA256 signature verification with constant-time compare on every inbound event.
Every webhook write goes through an idempotency key — idempotency protections help prevent duplicate processing.
Every admin action and edge-function call is logged for a full, reviewable trail.
Hourly snapshots with 30-day retention to protect operational continuity and disaster recovery.
Compliance
POPIA-built. Not POPIA-patched.
You own your data and can export it any time. Data-deletion requests are handled with a mandatory cooling-off period and full audit retention.
Primary hosting in South Africa · encrypted sensitive credentials at rest · you own your data, always