Trust architecture
Your regulator-grade evidence, in a platform engineered like a bank’s.
This platform holds statutory identity data, race and disability fields, assessment records that decide livelihoods, and your corporate clients’ workforce data. Security is a market position here, not a checkbox — so we publish the architecture rather than hiding behind a badge.
The honest version of “near impossible to penetrate”
No serious engineer certifies that a system cannot be broken into, and a vendor who does should be shown the door. What can be engineered — and what we specify — is a platform that is penetration-resistant by economic design:
- Assume breach. Every layer is designed as though the layer above it has already fallen.
- Nothing usable per layer. A stolen credential meets phishing-resistant multi-factor authentication and device binding. A compromised service meets an independent policy check and a row-level-security floor. A stolen database snapshot meets per-tenant ciphertext. A rogue administrator meets quorum controls and an immutable ledger that records the attempt.
- Blast radius capped at one tenant scope. Cross-tenant movement is prevented independently at four layers, and attempted continuously in our own pipeline.
- Detection before value. The telemetry and canary fabric is built so the cost and noise of a successful attack exceed its yield.
Authorisation, enforced at seven independent layers
- L1 Edge Web application firewall, bot management, per-tenant rate limits, geographic and network anomaly rules; mutual TLS inward.
- L2 Identity Passkeys as the default credential; phishing-resistant MFA mandatory for every privileged role; step-up authentication required for sensitive verbs — mark overrides, statutory file release, key operations, bulk exports. Authentication strength is itself an authorisation input.
- L3 Policy A relationship-based access-control engine holding the tenancy graph — platform, tenant, client, programme, cohort, learner — with role bindings scoped to nodes. “Assessor for this cohort within this client within this tenant” is a first-class, queryable, auditable fact. Deny by default.
- L4 Service Every API handler re-evaluates the policy decision locally. No ambient trust in the gateway; workload identity on service-to-service calls.
- L5 Database Row-level security on tenant and client identifiers as a mechanically independent floor — a service-layer bug or an injected query still cannot cross tenants.
- L6 Cryptography Per-tenant keys mean data crossing a tenant boundary is not merely forbidden but undecipherable. This is the layer that defeats the stolen-snapshot and misconfigured-backup attack classes.
- L7 Audit Every decision at layers three through six is an event. Anomalous grant patterns, privilege drift and unused entitlements are surfaced continuously.
Cryptography and erasure
Envelope encryption with per-tenant master keys in hardware-backed key management; field-level AES-256-GCM on special-category columns, with blind-index columns so a learner can be found by identity number without the plaintext ever being indexed. Crypto-shredding makes POPIA erasure and tenant offboarding provable and immediate, and it reaches backups by construction.
Isolation, proven continuously
Isolation is asserted at the policy, database and cryptography layers — and then proven: a cross-tenant test suite attempts, from a tenant-A principal, every API and query path against tenant-B data on every single build. Any leak fails the pipeline. An external penetration test runs before the first external tenant and at least annually, including a dedicated adversarial engagement where the attacker holds a full tenant-administrator credential.
Insider and integrity controls
Separation of duties encoded in policy — a marker cannot moderate their own marks; corrections are versioned events with dual visibility. Just-in-time, time-boxed elevation for platform operations, with no standing production administrator. Break-glass access requires a two-person quorum, fires alerts and is ledger-recorded before it unlocks.
Residency, resilience and recovery
South African region primary across three availability zones. Immutable, vault-locked backups on a 3-2-1 discipline. Recovery objectives of a 15-minute recovery point and a four-hour recovery time for core services, evidenced by quarterly restore drills — because an untested backup is theatre. Cross-region backup replication is available per tenant only under the cross-border transfer register with contractual safeguards; in-country-only is the default.
Certification — where we actually are
We will not claim certifications we do not hold. Our POPIA programme is complete before launch: section 19 safeguards, a registered Information Officer, operator agreements with every subprocessor, and data-protection impact assessments for AI marking and simulation telemetry. ISO/IEC 27001 is a roadmap commitment targeted within twelve months of general availability, and SOC 2 Type II is sequenced after it. Neither is held today. When they are, this page will say so and name the auditor.