Data-handling procedure · version 2026-09-06
Access expires. Evidence stays useful.
Customer provides controlled access → authorized cases run → credentials are revoked or expire → the report retains evidence facts, not secrets.
01Minimize
Prefer a customer-controlled test environment, synthetic data and a dedicated least-privilege identity. Do not request a production secret when a scoped token or customer-operated session is enough.
02Transfer
Never send secrets through the enquiry form or ordinary email. Use the agreed access route. Keep secret values out of tickets, report text, screenshots, logs and filenames.
03Isolate
Separate each engagement. Restrict access to the active reviewer and approved recipients. Do not copy credentials into unrelated tools or use customer material to train public systems.
04Test
Run only authorized cases. Redact tokens and unrelated data at capture. Stop on unexpected sensitive data, excess permissions or uncontrolled effects.
05Revoke
Revoke or expire temporary access after the relevant test, not merely after report delivery. Record revocation without recording the secret.
06Retain
Keep a redacted evidence index and the minimum facts supporting the result. Delete raw private evidence on the scheduled date, normally within 30 days.
Never request through ordinary email
Passwords, banking credentials, PINs, OTPs, private keys, OAuth client secrets, long-lived production tokens, customer exports or unredacted private logs. If a customer sends a secret unexpectedly, do not reuse it; notify the contact, move it out of the normal record, and require rotation or revocation.
Compromise response
Contain access, preserve only necessary incident facts, notify the authorized customer contact, revoke affected credentials, identify affected information and follow applicable POPIA notification duties. The responsible party—not an operator acting only on its instructions—makes required notifications to the Information Regulator and affected data subjects.
Operational gate
No private engagement should begin until the secure transfer route, storage location, approved subprocessors, deletion date, incident contact and credential owner are written into the schedule. This public procedure is a baseline, not a security certification.