How we protect our platforms
-
Card payments
- Card details are only ever entered on our payment processors' own secure pages, never on Bhadala's systems. Bhadala does not receive or store card numbers or security codes. We follow a PCI DSS security policy, and we review our processors' PCI DSS attestations every year.
-
Hosting and infrastructure
- Our platforms run on Laravel Cloud, a managed hosting platform with SOC 2 Type 2 and ISO 27001 certifications, in Amazon Web Services data centres in the United States. Applications run in private networks across multiple availability zones and cannot be reached directly from the internet.
-
Network protection
- All traffic passes through an edge network that provides DDoS protection and a web application firewall based on the OWASP Core Ruleset, and blocks requests for common attack paths before they reach our applications.
-
Encryption
- Our platforms are served only over HTTPS, and plain HTTP requests are redirected. On bhadala.co.za and bhadala.us, browsers are also instructed to use secure connections only. Our applications connect to the third-party services they use over encrypted connections.
-
Data protection and backups
- Databases are managed by our hosting provider. Only our applications and authorised administrators can connect to them, and connections require credentials. Production databases are backed up daily, and backups are kept for at least seven days.
-
Access control
- Access to production systems is limited to the people who need it. Administrative access requires multi-factor authentication and is granted by role. Credentials are kept in encrypted secret stores, never in source code.
-
Secure development
- Every change to our software is reviewed before it is merged, and automated tests and security checks run before it is deployed. Dependencies are monitored for known vulnerabilities.
-
Our security program
- We maintain written security policies that are reviewed every year, and we use Vanta to monitor our security controls continuously. Everyone on our team is required to complete security awareness training and accept our security policies. We review the security of the vendors we rely on.
Compliance status
Where each framework stands today. Reports themselves are shared through the Compliance Center.
SOC 2
In progress
Monitored continuously in Vanta.
PCI DSS
SAQ A-EP, in progress
Bhadala accepts no card data. Card entry happens only on our payment processors' hosted pages.
Subprocessors
These are the third parties that process data on Bhadala's behalf to run our platforms.
| Subprocessor | Purpose | Location |
|---|---|---|
| Laravel Cloud | Application hosting, databases and file storage | United States |
| Amazon Web Services | Underlying infrastructure for Laravel Cloud | United States |
| Cloudflare | Edge network, DDoS protection and web application firewall | Global |
| Stripe | Card payment processing (hosted pages) | United States |
| iVeri | Card payment processing (hosted pages) | South Africa |
| Ozow | Instant EFT payments | South Africa |
| Silicon Enterprise | Payment gateway integration | South Africa |
| Microsoft 365 | Company email | Global |
Reporting a security issue
If you believe you have found a security vulnerability in any Bhadala platform, please email info@bhadala.com with "Security report" in the subject line. We will acknowledge your report within three business days and keep you updated while we investigate. Please give us a reasonable time to investigate and fix the issue before disclosing it publicly.
Policies
Security documents for customers
Customers, integrators, prospects and auditors can get our security and compliance documents, such as our PCI DSS responsibility summary, penetration test summary, insurance certificate and Data Processing Agreement, from the Bhadala Compliance Center. Access is approved by our team and protected by two-factor authentication.