Compliance5 min read ·
How Valentry handles POPIA
Where client data lives, how brokerages are kept apart, how consent is recorded and who is responsible for what.
A brokerage holds identity numbers, bank details, medical and financial information about its clients. The Protection of Personal Information Act decides how that may be handled. These are the decisions built into Valentry, and what still sits with you.
Who is responsible for what
Your brokerage is the responsible party for its clients' personal information. Valentry processes that information on your behalf as an operator, under a written agreement. You decide why and how client data is used; we run the system that keeps it safe and does what you instruct.
Client data stays in South Africa
Client records and documents are stored on Google Cloud in the africa-south1 region, in Johannesburg. The region was chosen so client personal information does not leave the country, and it is fixed: we do not create databases or storage in any other region.
Every brokerage is kept apart by design
Valentry runs many brokerages on one platform. Separation is built into the structure, not left to careful coding:
- Your brokerage is worked out on the server from the signed-in user's membership, never from anything the browser sends.
- All data access goes through a handle scoped to one brokerage, so a query without a brokerage cannot be written.
- Every record carries its brokerage, and the database rules deny direct browser access entirely.
- Automated tests create two brokerages and check that every read path fails across the boundary.
Consent is recorded, never edited
Consent is captured per client, per purpose, with its lawful basis. A withdrawal or a change is a new entry that supersedes the old one. The history is never overwritten, so you can show what a client agreed to and when.
Documents are never public
FICA evidence, signed Records of Advice and e-signature packages are stored under your brokerage's private prefix. They are served only through short-lived signed links, issued after the requester's brokerage is confirmed. There is no public URL to share or leak.
Access ends when it should
Sessions are checked on every request. Suspending a team member revokes their sessions immediately, so a departed adviser loses access to your book now, not when a cookie happens to expire.
Changes leave a trail
Changes to clients, policies and team members are written to an append-only audit trail in the same transaction as the change itself. The trail is shown with redactions marked as redactions, not as blanks.
