Security & data handling

We help businesses check their own security and privacy, so we hold ourselves to the same standard. This page explains, in plain language, how we protect the information you give us.

What we store

• Your account details: email address, optional name, and how you signed in.
• Your assessment answers, notes, scores and history.
• Billing status from Stripe. We never see or store your full card number.
• Basic product usage events (for example “assessment completed”) so we can improve the product.

We don't ask for company details, and we suggest you don't put personal information about other people in notes.

How it's protected

• All traffic is encrypted with TLS. Data is encrypted at rest by our database provider.
• Row-level security in the database means each account can only read its own assessments (and its team's, on the Team plan).
• Changes to plans, scores and reports only happen on our servers, never directly from your browser.
• PDF reports are generated on our servers and aren't stored after download.
• Share links are long random tokens, expire after 90 days, can be switched off at any time, and never show private notes. Search engines are told not to index them.
• Passwords are handled by our authentication provider and stored as salted hashes. You can also sign in with Google or Microsoft.
• Staff access to production data is limited, logged, and only used to fix problems you report.

Where it's stored

Data is hosted with Supabase (database and authentication) and Vercel (application hosting). Payments are handled by Stripe and emails are sent through Resend. Each provider has its own security certifications and data processing terms. Some of these providers store data outside South Africa, with appropriate safeguards in place as POPIA requires.

How long we keep it

• Assessment history is kept for 12 months from completion, then deleted automatically.
• When you delete your account, your answers, scores and history are deleted straight away. Backups roll off within 30 days.
• Billing records are kept as long as tax law requires.

Your rights

You can see, download (as PDF) and delete your data from within the app at any time. For any other request under POPIA or GDPR, email info@khutsogrc.com.

Reporting a security issue

If you think you've found a security problem, please email info@khutsogrc.com with the details. We'll look into every report.