Trust & Security
How we protect your clients' information
Your clients trust you with ID documents, bank statements and FICA packs. Here is exactly what protects that information inside an OmniVault portal, and what we don't claim.
Need-to-know access
Every document, message and milestone belongs to one matter. Clients see only their own matters, and staff see only the matters they are assigned to. Only the firm's oversight administrator can add people to the staff list, and nobody can change their own role.
Private document vault
Uploaded files go into private storage with no public web address, and the file location is hidden from every portal user. Uploads are limited to PDF, JPG, PNG and DOCX files of up to 10MB each.
15-minute download links
A document only opens after a server-side permission check, through a signed link that expires after 15 minutes. A copied or forwarded link stops working almost immediately.
Audit trail
Uploads, document opens and matter changes are recorded with who acted, on which document and matter, when, and from which IP address. Portal users cannot edit or delete log entries.
Recorded POPIA consent
Clients give POPIA consent before they can upload anything. The exact wording, its version, the date and the IP address are stored, and the record cannot be changed afterwards. Uploads are refused until consent exists for that client and matter.
Retention and deletion
Records are kept for at least five years after a matter closes, the statutory period. After that, files are flagged, reviewed and permanently expunged: personal details are removed, the file is destroyed, and the erasure itself is logged. An expunged file cannot be registered again.
Hosting and cross-border storage
Portals run on Base44's cloud infrastructure, which is independently certified to SOC 2 Type II and ISO 27001. Data is stored in the United States. Clients are told this in the consent they give before uploading, and processing is covered by a written data processing agreement, as section 72 of POPIA allows for cross-border transfers.
Plain answers
- OmniVault is not separately certified. The SOC 2 Type II and ISO 27001 certifications belong to the infrastructure we build on.
- Data is encrypted in transit and at rest, but it is not end-to-end encrypted.
- OmniVault administrators access data only for support and maintenance, and every document an administrator opens is recorded in the audit log.
Need this for your compliance officer?
We'll walk your team through how the portal handles client data, step by step.
Request a security overview