Security
Your data stays yours.
Isolation, sign-in hardening and audit trails are built into the platform, not bolted on.
How we protect it
Four guarantees.
Isolated at the database
- Every record is walled off by tenant
- Company-level isolation for multi-entity groups
- Enforced in the database, not just in app code
Hardened sign-in
- Rotating sessions with reuse detection
- Account lockout after 5 failed attempts
- Single-use, expiring password resets
Audit trail on everything
- Who changed what, with before and after
- Deleted records keep their history
- Searchable history
Secure in transit
- Encrypted transport everywhere
- Script-proof session cookies
- Modern browser security headers
Compliance
Straight about where we are.
No badges we have not earned.
- Tools built in
Personal data (GDPR, POPIA)
Export and erasure tools for HR records, contact anonymisation and a consent ledger in CRM.
- On request
Data processing agreement
We process your data only on your instructions and sign a data processing agreement with customers who need one.
- Not stored
Card data
Card payments are handled by Stripe. We never store card numbers.
- Not certified
SOC 2 and ISO 27001
Isolation, audit logging and access control are built in. We hold no attestation or certificate.
Disclosure
Found something? Tell us.
Report vulnerabilities to us directly and in confidence.
security@metalogixerp.co.za