What this page covers
How we handle your data and your access while we build for you. It is a published commitment you can read before you sign, not a certificate. The contract and data processing agreement we sign with you are the binding version. For this website and the enquiries you send us, see the privacy policy.
We do not claim a status. We list what we sign and what we do.
What we hold, and where it lives
- Project work: code, documentation and infrastructure live in repositories and cloud accounts you own, from the first commit. We are invited into them. We do not host them. See ownership.
- Production data: it stays in your environment. We do not copy it into storage of our own.
- Website enquiries: the details you submit on this site are stored in our CRM, Twenty, so that we can reply. Vercel hosts the site and measures visits, Cloudflare Turnstile checks that a form is filled in by a person, and cal.com runs the booking calendar. The privacy policy lists each one.
Access control
- Access is per project, at the lowest permission the work needs.
- Every account that can reach your code, cloud or data uses multi-factor authentication.
- Every login is named; no shared accounts. Every action appears under a name in your audit logs.
- We work through invitations into your accounts. You can see who has access and remove it at any time.
- Access ends at handover. Revoking it is a line on the handover checklist.
Secrets
- Passwords, keys and tokens are never committed to a repository.
- They are held in a secrets manager in your cloud account, with a separate set for each environment.
- Every change is scanned for committed secrets before it reaches your link.
- At handover, secrets we have used are rotated or passed to you, as the checklist says.
Data minimisation
- We ask only for the personal data the work needs.
- Development uses synthetic or masked data. Production personal data is used in development only when you ask for it in writing.
- When the engagement ends, we delete or return the project personal data we hold, as the contract states, and confirm it to you in writing.
Encryption and change control
- Traffic is encrypted in transit with TLS. Managed data stores are encrypted at rest.
- Every deploy goes through a CI/CD pipeline with automated tests and a security review before it reaches your Friday link.
If something goes wrong
If personal data we process for you is accessed or disclosed without authority, we tell you without undue delay. The contract sets the maximum number of hours.
Our written notice states what happened, when, whose data is affected and what we have done about it. You decide whether to notify the regulator or the people affected. We give you what you need to do it.
South Africa and POPIA
Inventixx (Pty) Ltd is based in Centurion, South Africa, and is governed by the Protection of Personal Information Act, 4 of 2013 (POPIA).
- For enquiries sent through this website, we are the responsible party.
- For personal data you give us for a project, we are an operator. We process it only on your written instructions, under a written contract, and we apply the safeguards on this page.
Transfers from the EU and UK
South Africa has no EU adequacy decision. That is why we do not rely on a general promise. We sign the paperwork.
- EU and EEA: the European Commission’s 2021 Standard Contractual Clauses, Module Two (controller to processor), with Inventixx (Pty) Ltd as the importer, annexed to a data processing agreement. We support a transfer impact assessment on request.
- UK: the UK Addendum to those clauses, or the UK International Data Transfer Agreement, whichever your counsel prefers.
Transfers from Australia
Under Australian Privacy Principle 8.1 and section 16C of the Privacy Act 1988 (Cth), an Australian business that sends personal information overseas stays accountable for how the recipient handles it.
We sign a contract clause in which we agree to handle that information in line with the Australian Privacy Principles. It lets you show you took reasonable steps. Ask for it when you start.
Certifications
We do not currently hold ISO 27001, SOC 2 or a similar certification. What we publish is the list above. If your procurement process needs a completed security questionnaire, send it and we answer it in writing.
Report a security issue
Email hello@inventixx.io with “Security” in the subject line. A person reads it, and we acknowledge it within 24 hours on working days. For how we reply to everything else, see working hours.