Security and compliance, on the record.

Yes. Strategix Application Solutions is certified to ISO/IEC 27001:2022 by BSI, certificate IS 804839, valid to 28 August 2027, covering the design, development, delivery and support of the XGRC® cloud platform. The certificate can be checked in BSI's public certificate directory.

On Microsoft Azure in the West Europe region (Netherlands). Azure holds ISO 27001, ISO 27017, ISO 27018 and SOC 2 Type II certifications. There is no South African hosting option today; cross-border transfers are protected under our Data Processing Addendum.

Yes. Traffic uses TLS 1.2 or 1.3, and stored data is encrypted with AES-256 using keys unique to each customer, so one customer's key cannot open another's data.

Yes, through Microsoft Entra ID (Azure Active Directory), so your own password, MFA and leaver policies apply. MFA is enforced for all Strategix administrative access.

Immediately once we have reasonable grounds to believe your personal information has been accessed or acquired by an unauthorised person, and in every case within 72 hours of confirming an incident. A suspected security breach receives an initial response within 4 hours, 24 hours a day, 7 days a week.

A Recovery Point Objective of 1 hour and a Recovery Time Objective of 4 hours, backed by daily backups, hourly transaction logs and replication across locations. Recovery is tested every quarter and reviewed yearly by our external ISO auditor.

Automated vulnerability assessments and penetration testing run daily through our partner Hakware, and a manual penetration test is carried out every year. An executive summary is available under NDA.

Yes. Hakware's security operations centre monitors the platform around the clock, with SIEM and SOAR, and security, access and audit logs are retained indefinitely.

No. Strategix never uses customer data to train AI models. You choose which model MAIA® uses, and we can help you run a local model so prompts and data stay within your own environment.

Microsoft Azure (hosting) and Microsoft 365 (email), both in West Europe. Customers get 10 business days' notice of material changes and a right to object.

You can request a copy within 30 days of termination. Personal information is then deleted or irreversibly anonymised within 90 days, and a Data Destruction Certificate is issued.

Jacob O'Brien, with Deputy Information Officers Deneys Minne and Stan O'Brien, reachable at [email protected]. Our PAIA Manual explains how to request records we hold.

Data stays hosted in the Netherlands, and we sign the EU Standard Contractual Clauses on request for access from South Africa. Our Information Officer handles GDPR matters; we have no EU representative, as we act only as a processor.

Customers log it through the support portal at Severity 0. Security researchers can email [email protected] with the subject "Security vulnerability".

No. Our independent assurance is ISO/IEC 27001:2022 certification, and our hosting provider, Microsoft Azure, holds SOC 2 Type II.