Security & POPIA
How we protect your organisation's compliance, B-BBEE and Employment Equity information on the MetaCo platform.
Who can see your data
Every organisation's data is kept separate. Each request is checked on the server against the user's organisation and role, so a client can never see another client's records. Employment Equity data is limited to roles with EE access.
Signing in
Passwords are stored as one-way hashes. Accounts lock for 15 minutes after repeated failed attempts. MetaCo administrators and consultants must use two-factor authentication with an authenticator app; clients can switch it on in their profile.
Encryption
All traffic uses HTTPS (TLS). Files are kept in managed object storage, and two-factor secrets are encrypted before they are stored.
Downloads
Documents are downloaded through short-lived signed links that expire after 5 minutes and are tied to the signed-in user. Every download is recorded in the audit log.
Audit trail
Views and exports of employee personal information, changes to settings, calculations, approvals, deletions and restores are recorded with who did it and when.
Deleting and recovering
Deleted documents and employee records go to Recently deleted and can be restored for 30 days. After that they are removed permanently.
Uploads
Only common document and image types are accepted, with a size limit.
Backups
The database is backed up automatically every day and backups are kept for 30 days, so information can be restored if something goes wrong.
POPIA
MetaCo processes personal information only to deliver the services you engage us for, in line with the Protection of Personal Information Act. You can ask us for access to, correction of or deletion of your personal information at any time.
Questions? Email info@metaco.org.za.