Trust centre

Security you can inspect, not just read about.

These are the practices built into the platforms we run today. Ask us to show any of them in a live system. We would rather demonstrate a control than describe it.

Request security information

Tenant isolation

Every organisation's data is separated in the database itself.

  • Row-level security in PostgreSQL scopes every query to one organisation.
  • Platforms on the unified foundation connect with a restricted database role that cannot bypass isolation.
  • Isolation does not depend on application code remembering to filter.

Identity & access

People see what their role allows, and nothing more.

  • Email sign-in on every platform; Microsoft Entra ID single sign-on on Aivora and Zentra.
  • Roles and permissions set per organisation.
  • Administrators control who can switch on assistants and integrations.

Audit & accountability

Who did what, when and from where, recorded as it happens.

  • Sign-ins, changes, approvals and exports are written to an audit trail.
  • AI assistant questions and actions are audited in the same way.
  • Approval chains record who approved what, and when.

Governed AI

AI is a capability you switch on, not a default you discover.

  • Every assistant is off until an administrator enables it for the organisation.
  • Assistants see only what the signed-in user may see.
  • High-risk actions can be routed to a person for approval.
  • Usage and cost are visible per organisation.

Privacy & POPIA

Personal information is collected for a purpose and protected accordingly.

  • Data minimisation and purpose limitation are designed into each platform.
  • Hosting is chosen to meet your data-residency requirements.
  • Requests to access, correct or delete personal information are handled on request.

Secure engineering

Quality and security checks run before anything reaches you.

  • Automated tests and real-browser checks on every release.
  • Secrets are kept out of source code.
  • All public endpoints are served over HTTPS.

Reliability

Platforms are monitored, and problems are communicated.

  • A 99.9% availability target.
  • Health monitoring with alerts that reach an engineer.
  • Incidents communicated openly, including through public status pages.

Data ownership

Your data stays yours, and you can take it with you.

  • Exports in open formats at any time.
  • Documented APIs for everything the interface can do.
  • Clear handover if you ever choose to leave.

Reporting a security concern

If you believe you have found a vulnerability in an Alexon platform or this website, tell us privately.

  • Email info@alexontech.co.za with "Security report" in the subject.
  • Include enough detail for us to reproduce the issue, and give us reasonable time to fix it before disclosing it.
  • Please do not access other organisations' data or disrupt the service while testing.

For procurement and security teams

Completing a vendor assessment? Ask us for the security questionnaire responses and policy documents your process requires, and we will take you through them with an engineer.

Start a vendor assessment Privacy notice

Put our controls to the test.

Book a working session and we will show isolation, audit and AI governance in a live platform.

Start a conversation info@alexontech.co.za