Privacy Policy

AEGIS builds accounting and statutory-compliance software for professional practices. That work is only possible because firms trust us with their clients' financial and personal information. This policy sets out, plainly, what we hold, why we hold it, what we will never do with it, and how you get it back.

1Who we are

Item	Detail
Legal entity	AEGIS INTELLIGENCE SYSTEMS (Pty) Ltd
Company registration	2026/521302/07
Registered address	South Africa, Republic of South Africa
Information Officer	info@aegis.org.za
Information Regulator	Registered. Complaints may be lodged directly with the Regulator (see §12).
General contact	info@aegis.org.za · support@aegis.org.za
Website	aegis.org.za · Application: app.aegis.org.za

2The two roles we play — this distinction matters

POPIA draws a line between the party who decides why personal information is processed (the responsible party) and the party who processes it on their instruction (the operator). AEGIS sits on both sides of that line, depending on whose information is involved. We keep them strictly apart.

Whose information	Our role	What that means
Your firm's own — your staff, your billing contacts, your users	Responsible party	We decide the purpose (running your account, billing you, supporting you) and we are directly accountable to you under POPIA.
Your clients' — the books, contacts, employees and documents you load into AEGIS	Operator	Your firm is the responsible party. We process only on your written instruction, for your purpose, and for no purpose of our own. This is governed by our Operator Agreement (Document 04).

3What we collect

3.1 Information you give us directly

• Account and identity — name, work email, telephone number, role, firm name, company registration number.
• Billing — billing contact, VAT number, billing address, subscription and payment records. We do not store card numbers. Card data is captured and held by our payment processor (Paystack), never by AEGIS.
• Support — the content of messages, tickets and correspondence you send us.

3.2 Client information you load into the platform (we are the operator)

• Accounting records — trial balances, ledgers, journals, invoices, bills, bank transactions and statements, credit notes, allocations.
• Contact records — names, addresses, email addresses, telephone numbers and VAT numbers of your clients' customers and suppliers.
• Employee and payroll records — names, identity numbers, tax reference numbers, banking details, remuneration, deductions and payslips, where you use the payroll module. This is special personal information and we treat it accordingly.
• Documents — anything you or your clients upload: invoices, bank statements, contracts, source documents.

3.3 Information generated automatically

• Audit trail — every material action in the platform is written to an append-only audit log: who did what, to which record, when. This log is not deletable, including by us. It exists precisely so that a professional can defend what they signed.
• Access log — authentication events, sign-ins, MFA challenges, privilege changes.
• Technical — IP address, browser and device information, and error diagnostics, for security and to keep the service working.

4Why we process it — and the lawful basis

Purpose	Lawful basis under POPIA
To provide the platform you have subscribed to	Performance of our contract with you (s11(1)(b))
To process your clients' books on your instruction	Operator processing on the instruction of the responsible party (s20–21)
To bill you and collect payment	Performance of contract; our legitimate interest (s11(1)(f))
To secure the platform, detect abuse, and maintain the audit trail	Legal obligation and legitimate interest (s11(1)(c), (f))
To retain records where law requires it	Legal obligation (s11(1)(c))
To send you service and security notices	Performance of contract

We do not process your information for marketing without your consent, and where you consent you may withdraw it at any time without affecting the service you pay for.

5What we will never do

These are commitments, not aspirations. They are repeated in our Operator Agreement, where they are contractually binding.

1. We will not sell your data, or your clients' data, to anyone. Ever.
2. We will not train artificial-intelligence models on your clients' books — not raw, not aggregated, not anonymised — unless you instruct us to in writing, for your own purposes.
3. We will not use your clients' financial data for benchmarking, market research, or any product of our own.
4. We will not make it difficult for you to leave. Export is a function of the product, not a favour we grant.
5. We will not process your clients' information for any purpose you have not instructed.

6Who we share it with

We share personal information only with the sub-operators strictly necessary to run the service. Each is bound by a written agreement no weaker than this policy, and we remain accountable to you for their conduct.

Sub-operator	Purpose	Location of processing
Supabase	Database and file storage	European Union (EU-West)
Vercel	Application hosting	European Union / United States
Paystack	Payment processing (card data held by them, never by us)	South Africa / Nigeria
Anthropic	Document extraction and reasoning within the platform	United States
Email delivery provider	Transactional email (payslips, statements, notices)	European Union / United States

We will otherwise disclose personal information only where the law compels us (a court order, a lawful SARS or regulatory demand). Where we are legally permitted to tell you that such a demand has been made, we will tell you, so that you can exercise your own rights before we respond.

7Cross-border transfer

Some of our sub-operators process personal information outside South Africa. POPIA (s72) permits this where the recipient is subject to a law, binding corporate rules or a binding agreement that upholds principles of protection substantially similar to POPIA. We rely on binding contractual terms with each sub-operator to achieve that, and our primary database and file storage are hosted in the European Union, under the GDPR — a regime the Information Regulator recognises as substantially similar.

8How we protect it

• Encryption in transit (TLS) and at rest. Identity numbers, banking details and payslips are additionally encrypted at field level.
• A proven access boundary. Owner > Staff > Client. A staff member cannot read a client they are not assigned to; a client cannot read another client. This is not a policy document — it is tested adversarially, by execution, on every single change we make to the code.
• Multi-factor authentication on privileged accounts.
• An append-only audit trail that cannot be deleted, including by us.
• Production and development are separated at the key, the database and the code layer, with an automated gate that prevents any script, test or internal tool from reaching production data.
• Least privilege. Our people get access to client data only where support requires it, and every such access is logged.

9If there is a breach

Section 22 of POPIA requires notification where there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person.

Where we act as responsible party (your firm's own account information), we will notify the Information Regulator and you, as required by s22.

10How long we keep it

Category	Retention
Client accounting records (as operator)	For as long as you instruct. On termination: exported and then deleted on your written instruction, or retained where you are legally required to retain them.
Your firm's account and billing records	Five years after the end of the relationship — the period required by the Companies Act and the Tax Administration Act.
Audit trail and access log	Retained for the life of the account. Append-only; not deletable.
Support correspondence	Three years.
Marketing consents	Until withdrawn.

11Your rights

Under POPIA, a data subject may:

• Ask what we hold about them, and receive a copy (s23).
• Correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained (s24).
• Object to processing on legitimate-interest grounds (s11(3)).
• Withdraw consent where processing rests on consent.
• Complain to the Information Regulator.

Route your request correctly. If you are a data subject whose information sits in a client book loaded by an accounting firm, that firm is the responsible party and you should approach them. If they route it to us, we will act on their instruction promptly. If you are a user of our own service, write to the Information Officer at info@aegis.org.za. We respond within 30 days. Requests are made under PAIA — see our PAIA Manual (Document 03) and the prescribed Form 2.

12Complaints

Raise it with our Information Officer first — we would rather fix it than be told about it by a regulator. But you are entitled to go straight to the regulator, and we will not obstruct you:

Information Regulator (South Africa)	Detail
Complaints (POPIA)	POPIAComplaints@inforegulator.org.za
Complaints (PAIA)	PAIAComplaints@inforegulator.org.za
General	enquiries@inforegulator.org.za
Website	inforegulator.org.za

13Cookies and tracking

We use only what the service needs to work. A session cookie to keep you signed in, and a preference cookie to remember your settings. We do not run advertising trackers, we do not sell your browsing behaviour, and we do not embed third-party marketing pixels in the application. Where we use analytics on our public website, it is configured not to identify you personally.

14Children

AEGIS is a business tool sold to professional firms. We do not knowingly process the personal information of children (persons under 18) as data subjects of our own service. Where a client book you load contains information about a minor (for example a dependant on a payroll record), you are the responsible party for it and s35 of POPIA applies to your processing.

15Changes to this policy

We will post any change here and update the version and date above. Where a change materially affects your rights or how we process your clients' information, we will notify you by email before it takes effect — we will not change the terms of trust quietly.