Trust centre
Security you can check, not just trust
WorkVitals holds some of the most sensitive information an organisation has: what people really think, their health and the cases they report. Here is exactly how we protect it, and what is still in progress.
How we protect your data
Your data stays in South Africa
Client personal information, survey responses, case files and evidence are stored and processed in South Africa (Amazon Web Services, Cape Town region). No offshore databases, storage, logs or backups for client data.
Row-level security everywhere
Every tenant table is protected by row-level security in the database. An automated test fails the build if any table is missing it.
Anonymity threshold of 5, in the database
Survey results are only released for groups of five or more. The database enforces it, with complement and secondary suppression, so no screen or export can bypass it.
Column-level encryption
Contact details, case content and clinical findings are encrypted in the application with AES-256-GCM, with keys held outside the database.
MFA for privileged roles
Administrators, practitioners, investigators, partners and our own staff must use multi-factor authentication, enforced by the database.
Tamper-evident audit log
An append-only, hash-chained audit log records sensitive access. No role can edit or delete it, and clients can read their own log.
POPIA operator role
Each client is the responsible party; WorkVitals acts as its operator under a written operator agreement. Sub-operators such as our hosting provider are listed and assessed.
AI on aggregates only, off by default
The optional AI Copilot is off by default, receives only aggregated, de-identified results for groups of 5 or more, and logs every request. It cannot be switched on for public-sector clients.
Encrypted at rest and backed up in South Africa
Disks are encrypted with AWS KMS. Nightly encrypted backups go to storage in South Africa and are kept for 35 days in write-once (Object Lock) retention, so they cannot be altered or deleted early.
How your data is protected
South African hosting, each organisation sealed off, small groups hidden and case files restricted. The platform enforces these rules itself; nobody has to remember them.
Your people
Answer surveys and report concerns from any device
WorkVitals platform
Hosted in South Africa on Amazon Web Services, Cape Town region
- Each organisation sealed off by row-level security
- Anonymous answers unlinkable from identities
- Health and case records restricted to named practitioners, encrypted and audit-logged
Your leaders
See results only for groups of 5 or more
Email and SMS providers receive a contact and a link only. AI features are off by default and see aggregated data only.
Assurance status
We would rather tell you where we are than overstate it.
- Done
Internal penetration test
Done (October 2026)
- Planned
Independent penetration test
Planned, not yet done
- Planned
ISO 27001
On our roadmap. No certification is held.
- On request
Security questionnaire answers and controls summary
Available on request
Policies and your rights
Read our privacy notice and PAIA manual, or ask for our security controls summary.
See your organisation's vital signs
Book a 30-minute walkthrough. We will show you the portals with fictional demo data and price a plan for your headcount.