Compliance & Security

Last updated 2 July 2026

This page describes Insight 360's current security controls and the compliance frameworks we align with. It is maintained by Insight 360 and is not an independent certification - where we are working toward formal certification, we say so plainly.

Our posture

Insight 360 is built on a modern, managed stack (Cloudflare edge, Supabase Postgres, Anthropic Claude). We use platform-level controls where they exist, and layer our own controls on top. Our approach is privacy by default and least privilege - every user-owned table has Row-Level Security, and administrative access is scoped and logged.

Frameworks we align with

The following are frameworks we design our controls against. Except where explicitly noted, these are roadmap targets, not attestations Insight 360 currently holds:

  • POPIA (South Africa, Act 4 of 2013) - user rights, lawful processing, subprocessor management.
  • GDPR (EU) - data subject rights, DPO contact, transparent processing.
  • CCPA / CPRA (California) - right to know, delete, and opt out.
  • ISO/IEC 27001 - information security management (roadmap).
  • SOC 2 Type II - security, availability, confidentiality (roadmap).
  • HIPAA-ready - technical safeguards for healthcare tenants (roadmap; not yet available).
  • FERPA-ready - safeguards for education tenants (roadmap; not yet available).
  • OWASP Top 10 - reviewed in every release cycle.

Data protection

  • Encryption in transit - TLS 1.2+ enforced on every endpoint.
  • Encryption at rest - AES-256 for primary databases and file storage (provided by our infrastructure partners).
  • Row-Level Security - every user-owned table has RLS policies so tenants cannot read each other's data.
  • Backups - automated daily backups with point-in-time recovery on the primary database.
  • Data residency - please contact us if you have specific regional-hosting requirements.

Security controls

  • Authentication - email + OAuth (Google) via managed identity provider.
  • Session management - short-lived access tokens with rotating refresh tokens.
  • Rate limiting - per-user quotas on AI endpoints to reduce abuse and cost-exhaustion.
  • Input validation - schemas (Zod) on both client and server boundaries; AI output is validated before persistence.
  • Audit logging - privileged administrative operations are logged.
  • Dependency management - automated scanning and regular patch cycles.
  • Secret management - production secrets stored in the platform vault, never in source.

Subprocessors

Insight 360 relies on the following subprocessors to deliver the service:

  • Anthropic - AI model inference (Claude). Location: US.
  • Supabase - managed Postgres, authentication, and object storage. Location: EU / US regions.
  • Cloudflare - edge compute, delivery, and DDoS protection. Location: global edge.

Material changes to the subprocessor list will be announced in-app or by email with at least 14 days' notice.

Incident response

We maintain an internal incident-response process covering detection, containment, eradication, recovery, and post-incident review. If a security incident affects your personal information, we will notify affected users and, where required, the Information Regulator (or your local supervisory authority) within statutory timelines.

Responsible disclosure

If you believe you have found a security vulnerability in Insight 360, please report it to security@insight-360.co.za. We ask that you:

  • Give us reasonable time to investigate and remediate before public disclosure.
  • Avoid privacy violations, data destruction, and service disruption while testing.
  • Do not exploit a finding beyond what is necessary to demonstrate it.

We will not pursue legal action for good-faith research that follows these guidelines.

Accessibility

We build Insight 360 to meet WCAG 2.1 Level AA where possible - keyboard navigation, sufficient colour contrast, semantic landmarks, and screen-reader-friendly components. Report accessibility issues to support@insight-360.co.za.

Data Processing Agreements

Business customers who need a Data Processing Agreement (DPA) - including standard contractual clauses for international transfers - can request one from legal@insight-360.co.za.

Contact