Security & compliance

Security is not a feature. It's the foundation.

Every EchoPoint product is built to the same security baseline: encrypted at rest and in transit, audited by default, hosted in South Africa, and compliant with POPIA, ECT Act and PAIA.

Compliance

Aligned with the laws that govern your business.

POPIA — Protection of Personal Information Act

All products designed for data minimisation, purpose limitation, retention controls, and right-to-be-forgotten workflows. Privacy Impact Assessments available on request.

ECT Act — Electronic Communications & Transactions

EchoSign produces advanced electronic signatures that satisfy section 13 of the ECT Act 25 of 2002. Audit trails are cryptographically verifiable.

PAIA — Promotion of Access to Information Act

Our PAIA manual is published on this site. Information Officer contact details available on request. Subject access requests handled within statutory windows.

Infrastructure security baseline

Every product runs on the same hardened infrastructure. Here's what that means in practice:

TLS 1.3 everywhere. All traffic in transit encrypted with modern ciphers only.
AES-256 at rest. Documents, emails and backups encrypted with managed keys.
Hardware MFA for admin access. YubiKey-only for production systems. No SMS, no TOTP-only fallback.
SOC-style logging. Every action — view, download, share, policy change — is logged and tamper-evident.
99.9% uptime SLA. Backed by redundant infrastructure and tested disaster recovery.
Incident response runbook. Documented, exercised, customer-notified within 72 hours per POPIA.

// Example: EchoArchive audit chain
function signAuditEntry(entry) {
  const hash = sha256(
    entry.prev_hash + entry.payload
  );
  return {
    ...entry,
    hash,
    signature: hmac(hash, AUDIT_KEY)
  };
}
// Result: any modification is detectable on read
                

Disclosure

Vulnerabilities and responsible disclosure.

We take vulnerability reports seriously. If you've found a security issue in an EchoPoint product, please get in touch directly with our security team.

Email security@echopoint.co.za

PGP key available on request. We aim to acknowledge within 24 hours.