Trust you can check.
Who handles your data, where it lives, how we protect it, what we never do, and how you leave with it. Last reviewed on 8 November 2026.
Where your data lives.
The providers that process data for us, what each one does, and where. Each works under its own data processing terms.
| Provider | What it does | Where |
|---|---|---|
| AI model provider | Generates the AI agents' replies | United States |
| Cloud application hosting | Runs our application | Germany (EU) |
| Cloud database hosting | Stores our records | Ireland (EU) |
| Email delivery service | Delivers our emails | Outside South Africa |
| Google reCAPTCHA | Spam protection on our forms | United States and other countries |
| Video-call service | Hosts calls you book with us | United States and other countries |
| South African web host | Hosts this website and our mailboxes | South Africa |
| Online payment provider | Processes card and instant EFT payments, when you pay an invoice online | South Africa and other countries |
How we protect it.
Encrypted everywhere
Every connection to our site, our services and our database is encrypted.
Database locked down
Our database accepts only encrypted, authorised connections, with access rules on every table.
Named access, two-step login
Only named people can reach our systems, our accounts use two-step login, and keys are kept in a password manager, never in code or email.
Roles and an activity log
Our CRM has owner, sales and view-only roles, and every change is recorded.
Less data by design
Notification emails carry a short summary, not the full conversation. We collect only what a task needs.
Abuse protection
Rate limits and spam protection keep forms and the assistant safe from automated abuse.
Usage limits and a safe fallback
Our AI assistants run with a monthly usage allowance and warnings, and if the AI service is unavailable the visitor is offered the contact form, so the enquiry is not lost.
Opt-outs are permanent
Anyone who opts out of email is added to a permanent do-not-contact list, checked before every send.
What we never do.
- Sell personal information, or use your customers' data to market our own services to them
- Train AI models on your data; we do not train models at all
- Let an AI agent pretend to be a person, or give legal, medical or financial advice
- Publish a post, send a campaign or approve a payment on your behalf without the approval you set
- Hold your data hostage: you can take it with you at any time, and for 30 days after you leave
AI you can trust.
- Every AI agent we build says it is an AI, in line with the EU AI Act's transparency rules
- It answers only from information you have approved in writing, and says when it is not sure
- A person can take over at any point, with the conversation attached
- Anything public or risky waits for your approval
- Every conversation and agent action is saved, so you can see what was said and done
Your data, your exit.
- Your data stays yours. Under our standard agreement, you get a free export (CSV or JSON) within 14 days of asking, never tied to a buy-out.
- After your export, we delete your data and confirm it in writing. Backups that still hold it expire within 35 days.
- Month-to-month plans can be ended on 30 days' written notice.
If something goes wrong.
- If we have reasonable grounds to believe someone unauthorised has accessed your data, our standard agreement commits us to tell you immediately, and within 24 hours at the latest.
- For information we hold for ourselves, we notify the Information Regulator and the people affected as soon as reasonably possible, as section 22 of POPIA requires. For information we hold for you, we help you do the same.
- We tell you what happened, what we changed, and what you need to do, in plain words.
Found a security problem?
- Email info@icodeai.co.za with "Security" in the subject line, with enough detail for us to reproduce the problem.
- We confirm we have it within 2 business days and keep you updated until it is fixed.
- Please give us reasonable time to fix it before telling anyone else, and do not access other people's data, disrupt the service or send spam while testing.
- If you act in good faith and follow these rules, we treat your report as help, not as an attack.
- Our security contact is also published in the standard format at icodeai.co.za/.well-known/security.txt.
Need a security or compliance answer before you sign?
We are happy to work alongside your IT and legal teams. Ask us anything.