Trust, Security & Compliance
The Auditor Hub
Everything DBE auditors, school governing bodies, data protection officers and IT security teams need to evaluate and trust FutureReady Digital with South African learner data.
POPIA Compliant
SA Data Hosting
Information Officer Registered
Vulnerability Disclosure Policy
Overview
Compliance Overview
Current compliance status across all major regulatory and security frameworks
applicable to South African EdTech companies processing minor learner data.
9
/ 10
Compliance Score
Updated quarterly. Last reviewed October 2026.
POPIA Compliance
Registered Information Officer, compliant data processing, breach notification procedure in place.
Information Officer Registered
Registered with the Information Regulator of South Africa as required by POPIA Section 55.
SA Data Hosting
Platform, database and uploaded files hosted in Johannesburg. Only email delivery (EU) and the optional AI Study Assistant (US) process limited data abroad, as listed in our Privacy Policy.
Guardian Consent for Minors
Parental/guardian consent obtained at school registration before processing minor learner data.
Data Processing Agreement
Standard DPA available for all schools. Schools act as responsible party; we act as operator.
PAIA Manual Published
PAIA manual filed with the Information Regulator and available for public download.
Vulnerability Disclosure Policy
Published at /security/. 48h acknowledgement SLA. Safe harbour for good-faith researchers.
Encryption at Rest & Transit
Google Cloud encrypts all stored data with AES-256, and ID numbers and medical information are encrypted again by the platform. HTTPS only, with HSTS.
Breach Notification Procedure
Affected schools are told within 24 hours of us becoming aware of a breach, so the Information Regulator and the people affected can be notified as soon as reasonably possible, as POPIA Section 22 requires.
ISO 27001
Google Cloud, which hosts the platform, holds ISO/IEC 27001 certification. FutureReady Digital does not hold its own certification.
Protection of Personal Information Act
POPIA Compliance Summary
FutureReady Digital processes personal information of learners, including minors under 18,
in accordance with the Protection of Personal Information Act 4 of 2013.
Data Processing
What Data We Collect & Why
Full transparency on every category of personal information processed,
the purpose of processing, the legal basis, and how long it is retained.
Data Processing Register - FutureReady Digital (Pty) Ltd
Learner Identity Data
First name, last name, username, grade, school, class code
Learning Progress Data
Lesson completions, quiz scores, assignment submissions, video progress
Contact Details
Email address (optional), phone number (optional)
Device & Access Logs
IP address, browser type, login timestamps, device fingerprint hash
Mood Check-in Data
Daily mood rating (emoji only), optional text note
Parent/Guardian Details
Parent name, email, phone (where parent portal is used)
Technical Security
Security Measures
Technical and organisational measures implemented to protect learner data
against unauthorised access, loss, alteration or disclosure.
HTTPS Everywhere
All traffic uses HTTPS (TLS). HTTP connections are redirected to HTTPS, and HSTS tells browsers to use HTTPS only.
Active
Encryption at Rest
Google Cloud encrypts all stored data, including database records and uploaded files, with AES-256. ID numbers and medical information are encrypted again by the platform.
Active
Restricted Admin Access
The platform administration panel is open to platform administrators only. Every other role works inside its own school.
Active
Account Lockout Policy
Sign-in is locked for 15 minutes after 5 failed attempts, and login, registration and password reset are rate-limited by IP address.
Active
Device Fingerprinting
Simultaneous logins from different geographic locations are detected and flagged to school administrators.
Active
CSRF Protection
Forms and signed-in actions are protected against cross-site request forgery by Django's CSRF protection. The few endpoints that take calls from outside (payment notifications, scheduled jobs and unsubscribe links) verify a signature or token instead.
Active
SQL Injection Prevention
All database queries use Django's ORM with parameterised queries. No raw SQL with user input.
Active
Audit Logging
Logins, failed logins and administrative actions are logged with a timestamp and IP address.
Active
Security Updates
The platform runs on a Django release that receives security patches, and every code change is scanned for leaked secrets.
Active
ISO 27001 Hosting
Google Cloud, which hosts the platform, holds ISO/IEC 27001 certification. FutureReady Digital does not hold its own certification.
Google Cloud
Role-Based Access Control
Strict RBAC enforced. Students, teachers, school admins, parents and super admins each have isolated data access.
Active
Infrastructure
Data Hosting & Sovereignty
Johannesburg, South Africa
Primary Data Centre
South African Data Sovereignty
Hosted in South Africa
The FutureReady Digital platform, database and uploaded files are
hosted on Google Cloud's Johannesburg region, inside South Africa's
borders. The only providers that process limited data abroad are our
email delivery service and, where a school turns it on, the AI Study
Assistant, both listed in our Privacy Policy and used in line with
POPIA's cross-border transfer rules.
Primary: Johannesburg, Gauteng
Backups: Johannesburg, Gauteng
ISO 27001-certified Google Cloud data centres
Automated daily backups, kept for 7 days
AES-256 encryption at rest, HTTPS in transit
Responsible Disclosure
Vulnerability Disclosure Policy
We welcome responsible security research. If you discover a vulnerability
in FutureReady Digital, please disclose it responsibly using the process below.
Responsible Disclosure Process
We are committed to working with the security community to keep FutureReady Digital
and our users' data safe. We will not pursue legal action against researchers who
follow this policy in good faith.
1
Email the security team
Send a detailed report to security@futurereadydigital.co.za with steps to reproduce.
2
Receive acknowledgement
We acknowledge all reports within 48 hours and provide a tracking reference number.
3
We investigate & fix
Critical vulnerabilities are patched within 7 days. We keep you updated throughout the process.
4
Coordinated disclosure
We coordinate public disclosure with you after the fix is deployed. We credit researchers who wish to be named.
In-Scope Targets
The following systems are in scope for security research:
futurereadydigital.co.za (public website)
portal.futurereadydigital.co.za (learner portal)
API endpoints (authenticated)
Third-party services (out of scope)
Social engineering (out of scope)
Safe Harbour: We will not pursue legal action against researchers
who discover and report security vulnerabilities in good faith and in
accordance with this policy.
Report a Vulnerability
Cookie Policy
How We Use Cookies
We use only the minimum cookies necessary to operate the platform securely.
We do not use advertising or tracking cookies.
For Schools & Auditors
Technical Security Dossier
School Privacy Impact Assessment Pack
Schools and districts conducting their own POPIA Privacy Impact Assessments (PIAs)
can request our full Technical Security Dossier. This document pack simplifies
your school-level PIA by providing all the technical and governance information
you need about how we handle learner data.
- Data Processing Agreement (DPA) template
- POPIA compliance summary (for SGB presentation)
- Data flow diagram and processing register
- Hosting infrastructure and security controls overview
- Sub-processor list and transfer controls
- Incident response and breach notification procedure
- Data retention and deletion policy