UHAMBO ATLAS ACADEMY Request a demo

Trust architecture

Your regulator-grade evidence, in a platform engineered like a bank’s.

This platform holds statutory identity data, race and disability fields, assessment records that decide livelihoods, and your corporate clients’ workforce data. Security is a market position here, not a checkbox — so we publish the architecture rather than hiding behind a badge.

The honest version of “near impossible to penetrate”

No serious engineer certifies that a system cannot be broken into, and a vendor who does should be shown the door. What can be engineered — and what we specify — is a platform that is penetration-resistant by economic design:

  1. Assume breach. Every layer is designed as though the layer above it has already fallen.
  2. Nothing usable per layer. A stolen credential meets phishing-resistant multi-factor authentication and device binding. A compromised service meets an independent policy check and a row-level-security floor. A stolen database snapshot meets per-tenant ciphertext. A rogue administrator meets quorum controls and an immutable ledger that records the attempt.
  3. Blast radius capped at one tenant scope. Cross-tenant movement is prevented independently at four layers, and attempted continuously in our own pipeline.
  4. Detection before value. The telemetry and canary fabric is built so the cost and noise of a successful attack exceed its yield.

Authorisation, enforced at seven independent layers

  1. L1 Edge Web application firewall, bot management, per-tenant rate limits, geographic and network anomaly rules; mutual TLS inward.
  2. L2 Identity Passkeys as the default credential; phishing-resistant MFA mandatory for every privileged role; step-up authentication required for sensitive verbs — mark overrides, statutory file release, key operations, bulk exports. Authentication strength is itself an authorisation input.
  3. L3 Policy A relationship-based access-control engine holding the tenancy graph — platform, tenant, client, programme, cohort, learner — with role bindings scoped to nodes. “Assessor for this cohort within this client within this tenant” is a first-class, queryable, auditable fact. Deny by default.
  4. L4 Service Every API handler re-evaluates the policy decision locally. No ambient trust in the gateway; workload identity on service-to-service calls.
  5. L5 Database Row-level security on tenant and client identifiers as a mechanically independent floor — a service-layer bug or an injected query still cannot cross tenants.
  6. L6 Cryptography Per-tenant keys mean data crossing a tenant boundary is not merely forbidden but undecipherable. This is the layer that defeats the stolen-snapshot and misconfigured-backup attack classes.
  7. L7 Audit Every decision at layers three through six is an event. Anomalous grant patterns, privilege drift and unused entitlements are surfaced continuously.

Cryptography and erasure

Envelope encryption with per-tenant master keys in hardware-backed key management; field-level AES-256-GCM on special-category columns, with blind-index columns so a learner can be found by identity number without the plaintext ever being indexed. Crypto-shredding makes POPIA erasure and tenant offboarding provable and immediate, and it reaches backups by construction.

Isolation, proven continuously

Isolation is asserted at the policy, database and cryptography layers — and then proven: a cross-tenant test suite attempts, from a tenant-A principal, every API and query path against tenant-B data on every single build. Any leak fails the pipeline. An external penetration test runs before the first external tenant and at least annually, including a dedicated adversarial engagement where the attacker holds a full tenant-administrator credential.

Insider and integrity controls

Separation of duties encoded in policy — a marker cannot moderate their own marks; corrections are versioned events with dual visibility. Just-in-time, time-boxed elevation for platform operations, with no standing production administrator. Break-glass access requires a two-person quorum, fires alerts and is ledger-recorded before it unlocks.

Residency, resilience and recovery

South African region primary across three availability zones. Immutable, vault-locked backups on a 3-2-1 discipline. Recovery objectives of a 15-minute recovery point and a four-hour recovery time for core services, evidenced by quarterly restore drills — because an untested backup is theatre. Cross-region backup replication is available per tenant only under the cross-border transfer register with contractual safeguards; in-country-only is the default.

Certification — where we actually are

We will not claim certifications we do not hold. Our POPIA programme is complete before launch: section 19 safeguards, a registered Information Officer, operator agreements with every subprocessor, and data-protection impact assessments for AI marking and simulation telemetry. ISO/IEC 27001 is a roadmap commitment targeted within twelve months of general availability, and SOC 2 Type II is sequenced after it. Neither is held today. When they are, this page will say so and name the auditor.