01
Where your data lives
RevPulse runs on Microsoft Azure in the South Africa North region, in Johannesburg. The database, uploaded files and the app itself are hosted there.
Some suppliers handle parts of the service from outside South Africa, such as email delivery, address suggestions, payments and AI features. The Privacy Policy names each one and what it receives.
02
How it is protected
- Every connection uses HTTPS, with TLS 1.2 or newer.
- The database is not reachable from the internet. Only the app can reach it, over a private network.
- Uploaded files sit in private storage with no public links and no shared keys.
- Data is encrypted where it is stored: the database, files and backups.
- Sign-in codes are stored only as hashes, and passwords are hashed. Secrets live in a key vault, not in code.
03
Who can see it
- Each business sees only its own records. The server checks every request against the signed-in person's business before it reads or changes anything.
- Team members see what their role allows.
- RevPulse staff reach customer data through the admin console, to give support or keep the service safe. Opening a business's account as staff is logged.
04
Signing in
- You can turn on a second step that emails a code each time you sign in.
- The phone app keeps your session in the phone's secure storage.
05
Card payments
Card details are typed into the payment provider's own pages. RevPulse never sees or stores a full card number. The provider's security certification covers its pages, not RevPulse.
06
AI features
AI features run only after you agree to them, and they show what is sent and to whom before you start. Changes AI proposes are saved only after you check and approve them.
07
Records of changes
Changes to money records, such as invoices, income and expenses, are written to an audit log with who made them and when, in the same step as the change.
08
Backups and deletion
- The database is backed up automatically and backups are kept for 14 days.
- Deleted files are kept for 14 days in case they need restoring, then they are gone.
- You can close your account from the Account deletion page. Records that tax or other laws require us to keep stay until that period ends.
09
If something goes wrong
If personal information is accessed without authority, we tell the Information Regulator and the people affected as soon as reasonably possible, as POPIA requires, with what happened and what they can do.
To report a security problem, email legal@solcol.co.za.