Security, data protection and procurement

Tractivity runs on Microsoft Azure, with UK data residency by default and European, United States and other regions available. If in-country hosting is a requirement of your tender, raise it at the outset so the available options for your deployment can be confirmed in writing.

ISO 27001:2022, the international information security standard. Cyber Essentials Plus, backed by the UK National Cyber Security Centre. The NHS Data Security and Protection Toolkit, audited annually. Microsoft Azure hosting, which is SOC 2 compliant, in an environment meeting PCI DSS, HIPAA and ISO 27001 standards. Annual independent penetration testing by a CREST-approved organisation. Achilles UVDB Silver Plus membership, and a UK G-Cloud listing as a Government Commercial Agency supplier.

In a Tractivity deployment the client is the responsible party and Tractivity is the operator. Section 20 of POPIA requires an operator to process only with the responsible party’s knowledge or authorisation and to treat the information as confidential, and section 21 requires the relationship to be governed by a written contract obliging the operator to maintain the section 19 security measures and to notify the responsible party immediately where there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person.

A 99.95 per cent uptime guarantee with 24/7/365 monitoring. Daily encrypted backups stored in a separate secure location for 30 days, tested weekly by file integrity check and manual restore and signed off by a systems engineer and the Technical Director, with virtual machines restorable within 60 minutes. Security operations include 24/7/365 monitoring, a web application firewall, intrusion detection, regular vulnerability scanning and operating system file integrity and patch monitoring.

Tractivity meets WCAG 2.2 Level A today and is on track for Level AA during 2026. The platform is browser-based with no local software or plugins required for administrators or public users, and it uses no intrusive or non-essential cookies.

Sections 26 to 33 prohibit processing race or ethnic origin, political persuasion and trade union membership by default, and South African engagement records routinely contain all three. Permissions operate at project, module and record level, so those fields can be restricted to the roles that need them rather than being visible to everyone with access to the record.

No. AI features are off by default and activated only with your consent. All AI runs inside Tractivity’s Microsoft Azure environment, Azure OpenAI acts solely as a data processor, customer data is never used for model training or fine-tuning, every feature is configurable, and all AI is included in the subscription.

A foreign vendor with no South African entity scores nothing on B-BBEE, and on a scored tender that is a real deduction rather than a technicality. Where B-BBEE weighting is material, a South African partner or reseller arrangement is usually the answer. Raise it at the start of a bid rather than at evaluation.

Potentially, yes. Records of engagement held by a public body, including attendance registers, minutes, comment logs and grievance files, fall within the scope of a PAIA request. Field-level classification, redaction-friendly exports and a third-party notification workflow are built for that, and it is worth designing your configuration with PAIA in mind rather than after the first request.