Encryption in transit
TLS 1.2 or higher at the reverse proxy; HSTS enabled in production.
Trust Centre
Claims you can check.
This page describes what the platform does, where it runs, who processes data, and which claims are not yet true. It is updated with the product, not with the sales cycle.
Jurisdiction & hosting
South African law. European compute.
Those are two different facts, and we state both. RemoteRegister is designed for South African statutory obligations. The current production deployment runs on Hetzner in Helsinki, Finland.
Why this matters: a claim of “hosted in
Johannesburg” would be false for this deployment. POPIA section 72 permits cross-border processing
where an adequate level of protection is ensured; the safeguards are listed here.
- Governing law
- Republic of South Africa
- Data protection law
- Protection of Personal Information Act 4 of 2013 (POPIA)
- Information Officer
- [email protected]
- Production hosting
- Hetzner Online GmbH, Helsinki, Finland (EU)
- Transfer mechanism
- POPIA section 72 assessment with contractual safeguards
- Hosting-law overlay
- EU General Data Protection Regulation (GDPR)
- Evidence encryption
- TLS in transit; envelope encryption at rest
- Backup location
- Same contracted hosting environment unless a tenant contracts otherwise
Section 72 safeguards
- A data processing agreement with the hosting provider, including sub-processor and breach-notification terms.
- GDPR applies to the hosting environment, providing an adequate level of protection.
- Encryption in transit and at rest, with tenant-scoped access control.
- Audit logging of administrative and compliance-relevant actions.
- A published data-subject request route and Information Officer contact.
- Data minimisation: biometric templates, not raw fingerprint images.
Security programme
Controls, not adjectives
Each item below is implemented in the application or the deployment process. None of it replaces an independent penetration test; that is listed as an open item.
Encryption at rest
Provider volume encryption plus application-level envelope encryption for sensitive fields.
Authentication
Short-lived access tokens, rotating refresh sessions, optional OIDC SSO and TOTP for privileged roles.
Authorisation
Role and tenant scope enforced by API middleware, with separation-of-duties checks in finance and verification flows.
Audit integrity
Hash-chained audit entries and daily Merkle roots. The public verifier resolves hashes against sealed roots.
Backups
Integrity-checked snapshots with a documented restore drill. Production restores verify the audit chain before applying.
Rate limiting
Per-client sliding windows, Redis-backed in multi-worker deployments.
Security headers
Content-type protection, frame denial, referrer policy, permissions policy and production HSTS.
Incident response
Documented severity model, break-glass support protocol and post-incident review.
Secure development
Type checking, automated tests and dependency review in the release process.
What we do not claim
- We do not claim ISO/IEC 27001 certification.
- We do not claim SOC 2 attestation.
- We do not claim a South African physical hosting region for the current production deployment.
- We do not claim that a vendor integration is live until it has been smoked against that vendor.
- We do not claim that the biometric matcher is MINEX-certified in this deployment.
Subprocessors
Who may process personal information
The register names the processor, the purpose and the location. “To be confirmed” means the deployment does not yet have a contracted provider for that function.
| Processor | Purpose | Location | Notes |
|---|---|---|---|
| Hetzner Online GmbH | Cloud compute and block storage | Finland (EU) | Primary application and snapshot storage |
| Cloudflare, Inc. | DNS, TLS termination and proxy | Global edge | TLS and DDoS protection; no application database access |
| Email gateway | Transactional email | To be confirmed | Only if configured; otherwise transactional email is disabled |
| SMS / WhatsApp gateway | OTP and service notifications | To be confirmed | Only if configured; otherwise OTP routes return 503 in production |
| DHA reseller | Identity verification | South Africa | Only if configured; simulator mode otherwise |
| AVS-R bureau | Bank account verification | South Africa | Only if configured; simulator mode otherwise |
| Payout providers | Stipend disbursement | South Africa | Only if configured; sandbox or simulator mode otherwise |
| Biometric matcher / PAD vendor | Template matching and liveness | To be confirmed | Required for production biometric matching; contract defined |
Integration register
Built code is not a live channel
RemoteRegister ships adapters with explicit modes. Simulator mode is useful for demonstration and testing; it is never represented as a real external effect.
| Channel | Default mode | Go-live requirement |
|---|---|---|
| DHA identity | Simulator until configured | Certified reseller contract, credentials, smoke test |
| AVS-R bank verification | Simulator until configured | Bureau contract, credentials, smoke test |
| Payout rails | Simulator until configured | Provider onboarding, webhook secret, sandbox then live |
| SMS / WhatsApp | Disabled in production until configured | Local gateway contract and OTP handset test |
| Disabled until configured | Gateway URL and sender verification | |
| LMS connectors | Configured per tenant | LMS endpoint and credentials, connection test |
| Fingerprint matcher / PAD | Simulator until configured | Certified vendor contract and benchmark |
| Public verification | Live | Sealed ledger lookup only; fabricated hashes return NOT_FOUND |
Statutory mapping
The rules behind the features
POPIA Act 4 of 2013
Lawful processing, purpose limitation, minimality, consent records, Information Officer contact, data-subject request workflow and section 72 cross-border safeguards.
ECTA Act 25 of 2002, section 15
Data messages and electronic signatures are admissible where integrity and reliability are demonstrated. The audit chain and sealed evidence packs provide that record.
Sectoral Determination 5
Learnership stipend and working-hour rules are encoded in the stipend engine and attendance policy.
National Minimum Wage 2026 (GN R.7083)
Learnership floor tiers and shortfall top-up are applied deterministically during pay-run calculation.
SARS section 12H and ETI
Deduction schedules, ETI monthly summaries and IT14SD supplementary declarations are generated from the same learner and payroll records.
QCTO and SETA reporting
NLRD File 27/28/29 generators, SETA MIS mapping profiles and a quality gate before submission.
Data-subject requests
Access, correction, deletion and objection requests are logged and routed to the Information Officer. Email [email protected].
Responsible disclosure
Report a suspected vulnerability to [email protected]. Please do not test against learner data or a production tenant without written authorisation.
Status & incidents
Operational status is published at https://rr-status.medq.co.zw. Material incidents are disclosed there with the affected service and current state.
Need a security or POPIA questionnaire completed?
Send it. We will answer every line, including the ones where the answer is “not yet”.