Defensible by design: how we protect the data you entrust to us.
In South Africa, POPIA-compliant tracing is the actual product. This page sets out, in plain terms, where your data lives, who can see it, what we do with it and what we never do, so your information officer, auditors and trustees can satisfy themselves before the engagement letter is signed.
- Data residency
- Azure South Africa North
- Encryption
- AES-256 at rest · TLS 1.3 in flight
- Journal
- Immutable, append-only
- Secondary use
- None, ever
You are the responsible party. We are your operator.
A fund, insurer, bank, executor or registrar that traces the people it owes money to is processing their personal information to perform its own legal obligation and in their interest. That is the lawful basis under POPIA, and it belongs to you as the responsible party. xverified acts as your operator: we process only on your written instruction, under a processing agreement that forms part of every engagement letter, and we are bound by the same security and confidentiality duties that bind you.
Purpose limitation and minimisation are enforced at the field level. We take the fields the trace needs and no more, and the platform’s terminology, forms and exports are built for tracing, so your data cannot drift into another use.
What is in place.
- Data residency
- All client and case data is stored and processed in Microsoft Azure's South Africa North region (Johannesburg). Backups stay in the same region.
- Encryption
- AES-256 encryption at rest for databases and document storage; TLS 1.3 for every connection, including file transfer.
- Tenant isolation
- Each client is a separate tenant. Every query is scoped to the tenant, and the platform never aggregates or matches across tenants, even for internal metrics.
- Access control
- Staff and client users sign in through Microsoft Entra ID with multi-factor authentication. Roles limit who can view, adjudicate or export. Access is logged.
- Immutable journal
- Verification results and case events are append-only, enforced in the database. Nothing is edited or deleted after the fact, so the trail you receive is the trail that happened.
- Identity numbers
- Full ID numbers are masked in every application log and interface summary; the full number is held only in the data layer where the match runs.
- Field work
- Tracers carry a briefed case, not a database. Documents collected in the field are photographed straight into the case and are not retained on devices.
- Retention
- Data is returned or deleted at the end of the engagement as the letter specifies, apart from records FICA or FAIS require us to keep for the statutory period.
POPIA, FICA and the FSCA, in one trail.
- POPIA
- Lawful basis documented per engagement, operator agreement in every letter, purpose limitation at the field level, data-subject rights handled through the Information Officer, incident notification under section 22.
- FICA
- Identity verification to the standard a Risk Management and Compliance Programme can accept: Home Affairs confirmation, certified documents, and a record of how each identity was established.
- FSCA
- Outputs map to the Section 13 unclaimed benefits register, to the record of tracing effort the conduct standards expect, and to the Section 37C investigation trustees must be able to show.
- PAIA
- Requests for access to records are handled under our PAIA manual by the Information Officer.
Third parties that process data on our behalf are listed, with their location and purpose, on the sub-processors page. Our privacy policy covers this website and our own processing; the PAIA manual explains how to request records.
Four commitments.
- We never use one client’s records to enrich another’s, or to build a database of our own.
- We never hold or handle beneficiary money. Payment runs on your rails.
- We never charge, solicit or contact a beneficiary for a fee. Our fee comes from the institution that engaged us.
- We never move client data outside South Africa without your written agreement to a named sub-processor.
Security questions
On what POPIA basis is beneficiary tracing processed?
The fund, insurer, bank, executor or registrar is the responsible party. It processes the beneficiary's personal information to comply with its own legal obligation to pay the person it owes, and to protect the beneficiary's legitimate interest in receiving the money. xverified is its operator under a written processing agreement, which section 20 and 21 of POPIA require.
Does any data leave South Africa?
Client records and case data are stored and processed in Microsoft Azure's South Africa North region (Johannesburg). Where an optional sub-processor outside South Africa is used for a specific engagement, it is listed on the sub-processors page and agreed with the client in writing beforehand.
Do you use our records to enrich other clients' records?
No. Each client's data lives in its own tenant, and the platform never aggregates or cross-matches across tenants, even for internal reporting. Your records are processed for your engagement only.
What happens to the data when the engagement ends?
It is returned or deleted as the engagement letter specifies, apart from the records we must keep under FICA, FAIS or the engagement's own audit requirements, which are retained for the statutory period and then destroyed.
How are security incidents handled?
A security compromise affecting personal information is reported to the client without delay so that the responsible party can notify the Information Regulator and the data subjects as section 22 of POPIA requires. We support that notification with the journal of what was accessed.
Find your
unclaimed.
We start with a scoped sample sweep under a short engagement letter, typically 5 000 dormant records, so you see the recovery rate before you commit to a full programme. You pay only for beneficiaries we trace and verify. See how pricing works.