Compliance as a property of the code.

Built for the regimes identity answers to.

POPIA

South Africa’s Protection of Personal Information Act is the default regime: statutory deadlines, retention and breach obligations, and cross-organisation fraud reads shut until the regulator’s prior authorisation is held.

GDPR

The EU and UK GDPR as typed regimes, with erasure and export coordinated across services, alongside the Australian Privacy Act.

FICA and RICA

Reliance between organisations models what each regulatory purpose requires, and audit export lets an organisation meet record-keeping and inspection duties itself.

eIDAS 2.0

Levels of assurance, European person identification data, ETSI trusted lists and relying-party registration certificates, aligned with the implementing regulations.

Audit controls

The audit trail is designed against the logging requirements of ISO/IEC 27001 and SOC 2.

Secure by the way it is built.

Managed keys

Vault keys, webhook secrets and every credential, certificate and attestation signature go through a managed key service. No issuing key ever sits in a running process.

Fail closed

There is no default environment. A service with no real token verifier, signer or audit sealing refuses to start outside development.

Identity provider

People sign in through a standards-based identity provider over OpenID Connect. The platform depends on the protocol, not the product, so the provider is replaceable.

Relationship-based access

Authorisation is a relationship graph in the style of Zanzibar, its permission matrix tested on independent engines before it ships.

Second approvers

Maker-checker on onboarding, platform roles, price changes and adjudication; self-approval is refused.

Browser hardening

Strict content security policies on every surface; the browser’s credential API is permitted only where a credential is presented.

Supply chain

Pinned, current dependencies with permissive licences only; standards implementations written and tested in-house, with reference implementations used as test oracles.

We hold this page to the same standard.

This site sets no cookies, runs no analytics and records nothing about you. It is served with a per-request content security policy, HSTS preload, cross-origin isolation and a locked-down permissions policy, behind a web application firewall. Vulnerability reports are welcome at the address in our security.txt.