How we protect your data
Our customers are accountable to the people they serve. That accountability only works if the systems underneath are built for it, so security and compliance are treated as product requirements.
Data stays in South Africa
Systems that hold citizen data run in the AWS Africa (Cape Town) region. Personal information collected by a South African government customer does not leave the country in the ordinary course of operating our platforms.
We build to POPIA
The Protection of Personal Information Act governs how our customers may collect, use and store personal information. Consent capture, access control, retention and audit trails are designed into the products rather than bolted on afterwards.
Encryption in transit and at rest
Traffic to our platforms is served over TLS. Data at rest is encrypted using managed keys, and application secrets are held in a managed secret store rather than in configuration files.
Access is scoped by role
Every product uses role based access control, so a user sees only the records and functions their role requires. Administrative actions are recorded against the account that performed them.
Separation between customers
Our municipal platforms are multi tenant. Each customer organisation is isolated within the system so that one municipality cannot read or alter another municipality’s records.
Dependencies are monitored
We track published advisories against the software our products depend on, and we patch. Where a fix requires a breaking change, we schedule and communicate it rather than leaving the exposure open.
Reporting a security issue
If you believe you have found a vulnerability in one of our systems, please tell us before disclosing it publicly. We will acknowledge your report, keep you updated while we investigate, and we will not pursue action against anyone who reports in good faith.
security@helloworld.africaWhat to include
- The product or address affected
- What you did, in enough detail for us to repeat it
- What you were able to access or change
- How we can reach you for follow up