Trust / Compliance
Compliance
Under POPIA the client is the responsible party and Phase Transitions its operator. This page states that position, the data-subject rights and the mechanism behind each, the sub-processors, resilience, and insurance. The control posture itself is on the SOC 2 page.
POPIA: operator and responsible party
You are the responsible party for your data and Phase Transitions acts as your operator, processing it on your instruction and for your purposes. Accounting-platform data is held in the EU. WealthVault and trading-tool data are held in South Africa. Where clients are financial-services providers, they remain separately regulated. Phase Transitions is not itself an FSP.
Data-subject rights, mapped to mechanisms
- Access. Every figure traces back to its source record and can be produced.
- Correction. Corrections are made in your source system, which stays the source of truth, and flow through on the next sync or upload.
- Deletion. Your database can be deleted in full when the engagement ends. A deletion has been drilled end to end.
- Objection. You can revoke our access at any time, which stops further processing.
- Portability. You can take a full export of your data in a standard format.
Sub-processors
The third parties that touch client data or the infrastructure it runs on. Phase Transitions is the contracting entity for each.
| Provider | Role | Residency | Attestation |
|---|---|---|---|
| Render | Per-client PostgreSQL databases and application hosting for the accounting analytics platform. Client data at rest. | EU (Frankfurt) | SOC 2 Type II |
| Amazon Web Services | All infrastructure for the WealthVault platform: compute, database and token vault, key management, sign-in, load balancing and monitoring. | South Africa (Cape Town, af-south-1) | SOC 2, ISO/IEC 27001 |
| Microsoft (Azure, Entra ID) | All infrastructure and sign-in for the trading tool: container hosting, database, key management, the immutable audit archive and monitoring. Users sign in with their own organisation's Microsoft work accounts. | South Africa (Johannesburg, South Africa North); Entra directory data in EMEA | SOC 2 Type 2, ISO/IEC 27001 for Azure |
| Cloudflare R2 | Object storage for raw source data and the document store. Data at rest. | EU | SOC 2 Type II, ISO 27001 |
| Files.com | Managed SFTP endpoint for partner data ingress, mounted onto our EU storage. Data rests on Cloudflare R2, not on Files.com. | EU region; data rests on our EU storage | SOC 2 Type II, CSA STAR, PCI DSS |
| Auth0 (Okta) | Identity and authentication for accounting-platform dashboards: passwordless email sign-in. | EU SCCs in the DPA | SOC 2 Type II, ISO 27001 |
| Anthropic | The AI analyst layer on the accounting platform. Read-only query results under commercial no-training terms; personal information is tokenised where an engagement puts it in the AI's reach. | US; EU SCCs | SOC 2 Type 2, CSA STAR Level 2 |
| Resend | Transactional email: one-time sign-in codes and delivery receipts. Recipient addresses pass through; no financial data. | US; EU and UK SCCs in the DPA | SOC 2 Type II |
| Sentry | Error capture across the platform services. Events can carry request context in flight; no client data at rest. | US; EU SCCs and UK addendum in the DPA | SOC 2 Type II, ISO 27001 |
| Checkly | Uptime and heartbeat probes against public health endpoints. Holds no client data. | Not applicable (no client data) | SOC 2 Type 2 |
| GitHub | Source control and CI for platform code. Holds no client data; secrets are excluded from source control. | US | SOC 2 Type II, ISO 27001 |
Data-processing agreements are on file for every provider that processes client data. Anthropic's SOC 2 report is held on file. The register with each agreement is part of the vendor-onboarding review pack.
Resilience: daily backups, a drilled restore, an incident-response plan, and a continuity plan.
Databases are backed up daily. A restore has been drilled with a measured recovery time and verified integrity. A written, cross-system incident-response plan covers the South African reporting clocks (POPIA, the Cybercrimes Act, and the FSCA/PA Joint Standard) and has been exercised as a tabletop. A business continuity plan covers the loss of any provider or workplace: every service rebuilds from version-controlled code onto fresh infrastructure, and operations are location-independent.
Insurance: professional indemnity and cyber liability cover is in force.
A professional indemnity (R5m) and cyber liability (R1m) policy in the name of Phase Transitions (Pty) Ltd is in force. The confirmation of cover is part of the vendor-onboarding review pack.