Security

Last updated 21 September 2026

Your reporting contains your people and your performance. This is where that sits, who can reach it, and what happens to it — in enough detail to hand to whoever asks in your business.

Where your data sits

Every client has their own database. Not a shared table with a column marking which rows belong to whom — a separate database, reachable only through its own connection. There is no query anybody could write, including us by accident, that returns one client's figures alongside another's.

It is hosted in South Africa, on a dedicated server rather than shared hosting. Your reports and the files you send sit outside the web root entirely, so there is no address that serves them directly.

Every database and every client’s files are backed up nightly, and each backup is copied to object storage in Cape Town — separate infrastructure from the server it protects, and still inside South Africa. Each copy is checked by reading it back after it is written, because an unverified backup is a guess and the failure that matters is discovering on restore day that months of them were empty.

The credentials the server holds for that storage can add and remove copies but cannot destroy the retained versions. Somebody who takes the server can stop new backups and hide the existing ones; they cannot delete them.

Who can reach it

• Access is checked on every single view, not once at sign-in.
• You decide who sees each report: everyone at your organisation, named individuals, or a team. A team grant only ever adds — it never silently removes access somebody was given directly.
• Access can be pinned to your own IP ranges. The address you are working from is never the one that locks you out, and it is yours to set.
• Sessions are carried on cookies that are HTTPS-only and unreadable to scripts, and the site is served over HTTPS with no plain-HTTP route in.
• Repeated failed sign-ins are slowed down automatically.
• Our own staff need a second factor: a password gets them to a code we email, and nothing else. A browser can be trusted for thirty days, and that trust is listed and revocable. Your people are not asked for one — when you want them to be, tell us.

What is written down

Every report opened, every permission changed, every failed attempt to reach something — who, when, which version, from what address. When somebody asks who has seen a figure, you answer from a record rather than from memory.

Where our staff act inside your account to help you, the entry names the member of staff who did it rather than the account they were working in. An unexplained gap in who-did-what is the thing an argument turns on, so there isn't one.

Activity records are kept for 24 months and then deleted. Entries that are themselves the record of something consequential — an invoice raised, a client's data destroyed — are kept as long as the thing they describe.

How a report is delivered

A report is a page we build from the data you send, and we treat that data as untrusted — because it arrives from an export we did not write, and because that is the only safe assumption.

• Nothing in your data can become part of the page's own instructions. A name, a note or a filename containing markup is displayed as the text it is, never acted on.
• Reports are served under a policy that permits only the code we shipped to run. Anything else in the page — however it got there — is refused by the browser rather than trusted.
• A report can only be framed by our own pages, cannot send data anywhere, and is never cached by a proxy or left in a shared machine's browser.

Files you send us

Uploads are checked for type before they are accepted and stored outside the web root, with no address that serves them. The only way a file leaves again is as a download by one of your own administrators, or by our staff supporting you. A file that does not match the shape the report expects is refused with the reason, rather than half-imported.

Where a report has been set up to read your own export, the file is converted into the report’s columns while it is processed. That working copy is kept in your own storage area and deleted as soon as the import finishes; one left behind by an interrupted run is removed within a day. The file you sent is the one that is kept.

A report imports only the columns it uses. Anything else in a file is not imported, but stays in the stored file for as long as the file is kept — so leave out of your uploads what your reports do not need, particularly details about your own customers.

The 10 most recent files for each report are kept. Older ones are deleted, and the figures they brought in stay in your version history.

Sending files automatically

There are three ways to send us a file without anybody uploading it: your system can post it to us, we can collect it from a folder of yours, or you can email it. Each connection reaches one report and nothing else, so a system of yours that is compromised cannot reach the rest of your data. Every file goes through exactly the same checks as one uploaded by hand.

Posting it. The token is shown once, when it is made; we keep only a fingerprint of it, so it cannot be recovered and a leak of our database does not yield a working token. It is sent in a header rather than in the address, because an address is written to logs and error trackers.

Us collecting it. We generate the key and give you only the half that admits us. Our half is encrypted where it is stored, never shown again, and destroyed the moment you stop the connection — at which point we tell you which line to remove from your own server, because we cannot remove it ourselves. We record your server’s fingerprint the first time we connect and refuse anything afterwards that does not present it, and we connect only to an address we have checked. We never delete anything on your server, and there is no setting that would let us.

Emailing it. The address is long and random and appears in no directory, and it reaches one report. You can restrict which senders it accepts, and where you do, we check that a message really came from the domain it claims before accepting it. We keep the attachment and a record of the message, never the body.

Be aware that email is the least protected of the four routes: it travels over the public internet through your mail provider and ours, encrypted between hops where both support it and not guaranteed to be. That is true of email generally rather than of us particularly, and it is why we would point you at one of the others for anything sensitive.

How long we keep it

For as long as you are a client, the figures from every upload are kept as a version history: any earlier version of a report can be opened again or exported. When you close, everything stays retrievable for 90 days — so a decision made in a difficult month can be undone — and is then permanently destroyed: the database dropped, the files removed. That happens automatically rather than when somebody remembers, and the record that it happened is kept after the data is gone. Copies in the nightly backups, each kept for 14 days, age out within 14 days after that.

Enquiries from our website are deleted after 24 months without contact. The full detail is in the Privacy Policy, and what we commit to as your operator is in the Operator Policy.

What we do not hold

• No card or bank details. There is no payment gateway; invoices are paid by transfer, and we never see the account they came from beyond the reference.
• No marketing list. What you send us when you enquire is used to answer you.
• No copies of your data anywhere we have not told you about.

What we do not claim

A security page listing only strengths is a sales page, and anybody whose job is to assess one knows it. So, plainly:

• We hold no security certification — no ISO 27001, no SOC 2. We are a small South African business and we are not going to imply otherwise.
• We have not commissioned an external penetration test. If your procurement requires one, tell us and we will discuss arranging it.
• We have restored a client’s database from the off-site copy and checked every table against the live one, row for row. We have not rehearsed that onto fresh infrastructure — if this server were lost, the rebuild would be a first attempt.

If something here matters to a decision you are making, ask — a straight answer now is worth more to both of us than a discovery later. Get in touch.