Security & data

Where your audit evidence lives and how it is protected.

Hosting: South Africa. Your compliance records do not leave the country in the ordinary course of the service.
Encryption: TLS 1.2+ in transit; encryption at rest.
Access control: role-based permissions, MFA available on all accounts, full audit trail on every record.
Backups: automated daily backups with tested restores; retention documented in the terms.
Incident response: security compromises notified to affected customers and the Information Regulator as required by POPIA section 22.
Sub-processors: published list with entity, function and country; POPIA operator agreements in place with each.
Your exit: full export in an open format, free, within 30 days of termination.

Procurement teams: request our completed vendor security questionnaire at info@ascfoodsafety.com.