Infrastructure
Cloud Infrastructure
BizAP runs on Supabase (hosted on AWS Frankfurt) and Render.com. Both providers maintain SOC 2 Type II certification and ISO 27001 compliance. Our infrastructure is entirely managed within secure data centres with physical access controls, redundant power, and 24/7 monitoring.
Network Isolation
Application components are deployed within private networks with restricted egress rules. Public-facing endpoints are protected by Web Application Firewalls (WAF) and DDoS mitigation. Database instances are not publicly accessible and can only be reached by authorised application services.
High Availability
Critical services are deployed with redundancy and automatic failover. We target 99.5% monthly uptime. Database backups are taken daily and retained for 30 days, with point-in-time recovery enabled. Backups are encrypted and stored separately from primary data.
Data Encryption
Encryption in Transit
All data transmitted between your browser, our mobile apps, and BizAP servers is encrypted using TLS 1.2 or TLS 1.3. We enforce HTTPS across all endpoints and use HSTS to prevent protocol downgrade attacks. We do not support legacy SSL or TLS 1.0/1.1.
Encryption at Rest
All data stored in our databases and file storage is encrypted at rest using AES-256. Encryption keys are managed by our cloud providers' key management services with access strictly limited to authorised services. Backup data is also encrypted before storage.
Access Controls
Role-Based Access Control
Access to customer data within BizAP is governed by role-based access control (RBAC). Agents, supervisors, and administrators are granted only the minimum permissions necessary for their role. Row-level security (RLS) in the database ensures tenant data isolation — no customer can access another customer's data.
Multi-Factor Authentication
We support and encourage multi-factor authentication (MFA) for all user accounts. MFA is mandatory for BizAP internal staff accounts. We support TOTP authenticator apps. Suspicious login attempts trigger additional verification challenges.
Internal Access Controls
BizAP employee access to production systems follows the principle of least privilege. Access is granted on a need-to-know basis, subject to approval, and reviewed quarterly. All privileged access is logged. Production database access requires VPN and MFA. Departing employees have access revoked immediately upon offboarding.
Application Security
Secure Development
Our development team follows secure coding practices based on the OWASP Top 10. All code changes undergo peer review before merging. Dependencies are monitored for known vulnerabilities using automated scanning tools. Security patches are applied within 72 hours of a critical CVE being published.
Penetration Testing
BizAP undergoes independent penetration testing at least annually. Findings are triaged by severity and remediated according to defined SLAs: critical within 24 hours, high within 7 days, medium within 30 days. Results are reviewed by senior management and drive our security roadmap.
API Security
All API endpoints require authentication via JWT tokens with short expiry windows. Rate limiting is applied to all endpoints to prevent abuse. Webhook payloads from Meta's WhatsApp API are verified using HMAC-SHA256 signature validation before processing. SQL injection, XSS, and CSRF protections are enforced at the application layer.
Monitoring and Incident Response
Continuous Monitoring
Our infrastructure is monitored 24/7 with automated alerting for anomalous activity, error spikes, and performance degradation. Security events — including failed logins, privilege escalations, and unusual data access patterns — are logged to a centralised SIEM and reviewed by our team.
Incident Response Plan
BizAP maintains a documented Incident Response Plan (IRP) that is tested annually. In the event of a confirmed security incident, our response team is activated within 1 hour. Affected customers and, where required, the Information Regulator are notified within 24 hours of confirmed impact. Post-incident reports are provided for significant events.
Responsible Disclosure
We welcome reports from the security community. If you discover a potential security vulnerability in BizAP, please contact us at security@bizap.co.za with a description of the issue. Please do not publicly disclose the vulnerability until we have had a reasonable opportunity to investigate and remediate.
We commit to:
- Acknowledge your report within 2 business days
- Provide a status update within 7 business days
- Notify you when the issue is resolved
- Credit you in our security acknowledgements if you wish
We do not take legal action against researchers who report vulnerabilities in good faith and in accordance with this policy.
Questions
For security-related questions or concerns, contact us at security@bizap.co.za. For data protection and POPIA enquiries, see our POPIA Statement.