Trust & security at Phase Transitions
Phase Transitions (Pty) Ltd builds and operates custom data and AI software for business clients: an accounting analytics platform with an AI analyst, WealthVault, which consolidates client statements for advisory firms, and a trading tool for an investment manager. Under POPIA it acts as an operator for its clients, who remain the responsible parties. The company is the vehicle for Graham Rowe's work: he is its director and registered Information Officer, and the person a client deals with.
Core controls
- Read, never write. The AI reads finished, reconciled figures through a read-only database role. It cannot author or change them, and makes no automated decisions.
- Isolated per client. A separate database and credentials per client, with the isolation verified by an automated test in CI.
- Minimal AI exposure. The AI reads only, and stores nothing at rest. Where personal information is in its reach, it is tokenised first.
- Encrypted and backed up. AES-256 at rest, TLS 1.2 or higher in transit, daily backups with a drilled restore.
- Documented and evidenced. 22 signed policies and procedures, 12 operating procedures mapped to SOC 2 and ISO 27001, and a quarterly evidence cycle.
-
SOC 2 posture
self-assessed ยท 10 of 12 procedures operatingThe twelve operating procedures and their status, the control mapping to SOC 2 and ISO/IEC 27001, the signed policy set, the evidence cadence with dates, and what is not in place. No SOC 2 report, no ISO certificate, no external penetration test.
-
Your data
Where client data lives, how it is isolated and encrypted, and the residency position: managed cloud in the EU and in South Africa, one database per client, tokenisation before the AI boundary.
-
How it works
The three platforms, the read-never-write boundary, managed passwordless authentication that denies by default, and the reviewed, tested path every change takes to production.
-
The AI analyst
What the AI can see and why it cannot change anything: read-only data at query time, tokenisation where personal information is in scope, no training on client data, and guardrails enforced in CI.
-
Compliance
The POPIA operator position, data-subject rights mapped to mechanisms, the named sub-processors, resilience and continuity, and insurance.
Clearing Phase Transitions as a vendor? The review pack and how to ask for it are on the SOC 2 page.