A person approves every decision
The system recommends an allocation. It never finalises one. POPIA requires human involvement where a decision substantially affects someone, and beneficiary fund administration affects people directly.
Security and governance
Written for the people whose job is to find the problem.
In financial services the decision is not made by one person. It is made by a committee, and security, legal, compliance and procurement each have a veto. This page exists so they can get their answers without booking a call.
The short version
Four answers, up front
Member identity never leaves your environment
Identification happens locally, inside your systems. Only de-identified text is interpreted anywhere else. Beneficiary funds serve minors and POPIA is strict about children's information, so this was a design constraint from the beginning.
Read only during Phase 0
No write access at any stage of the measurement. Nothing is changed in your environment, and there is no integration work. If your security team prefers a supervised session over credentials, that works for us.
Your platform stays the system of record
We are not a migration and we do not want to hold your master data. We work on the administrative layer around your core system, which continues to be the authoritative source.
Data handling
What touches what, at each stage
Set out as a table because that is how a security review will want it.
| Stage | Access required | Personal information | Changes to your systems |
|---|---|---|---|
| Introduction | None | None. The demonstration uses synthetic data | None |
| Phase 0 measurement | Read only reporting | Aggregate volumes and timings. No member records leave your environment | None |
| Pilot | Scoped, agreed in writing | Identification runs locally. Only de-identified text is interpreted externally | Runs alongside. Your process is unchanged |
| Production | Scoped integration | As above, with a full audit record written for every recommendation and decision | Integrated. Your platform remains the system of record |
The honest caveat. Detailed technical controls, certifications and a
formal data processing agreement are the things a full vendor assessment will ask for next. We
are early, and rather than claim certifications we do not hold, we would rather tell you exactly
where we are and work to whatever your assessment requires.
POPIA
How the design maps to the Act
Not a compliance statement written afterwards. These constraints shaped what was built.
Automated decision making
POPIA restricts decisions based solely on automated processing where they substantially affect a person. Our answer is structural: a person approves every allocation, so the decision is never solely automated.
Children's information
Beneficiary funds serve minors, where POPIA is strictest. Member identity is resolved locally so that identifying information about a child does not leave the responsible party's environment.
Minimality
Phase 0 uses aggregate reporting rather than member records, because the measurement does not need them.
Accountability and records
The workflow writes what arrived, what was recommended, who decided and why. A step that produces no record today starts producing one.
Regulatory
FSCA Conduct Standard 2 of 2025
The standard requires structured complaints handling and proper record keeping from Section 13B administrators, with deadlines running through this year.
The relevant point is that the audit trail is produced as a by-product of doing the work rather than as a separate reporting exercise. You are not buying compliance tooling. You are removing manual effort, and the evidence trail exists because the system writes down what happened.
We are not your compliance advisers and we will not tell you this makes you compliant. Whether it satisfies your obligations is a judgement for your compliance function.
Commitments
Things we will not do, including if asked
Finalise a decision without a person
Even where a client would prefer the throughput, we will not remove the human approval step on an allocation that affects a beneficiary.
Move identity out of your environment
Identification stays local. If an architecture requires otherwise, we would rather not take the work.
Claim certifications we do not hold
We will tell you exactly what we have and have not been assessed against, and work to what your review requires.
Next step
Send us your vendor assessment questionnaire
We would rather work through it early than discover a blocker after three meetings.