Security and POPIA
POPIA is the law here. It's built into the product.
How andteam stores, protects and processes employee data, and the tools it gives your Information Officer. Your organisation decides what it collects and why; andteam processes it on your behalf, as your operator under POPIA.
ISO/IEC 27001
Controls aligned to ISO/IEC 27001:2022, on certified infrastructure.
Our controls follow its Annex A, and formal certification is in progress. The programme covers the information security management system and its policies, the risk assessment and Statement of Applicability, incident response and breach notification, access reviews, staff screening and security awareness, an independent penetration test, and the Stage 1 and Stage 2 audits.
andteam runs on Google Cloud, which holds its own ISO/IEC 27001, 27017 and 27018 certifications and covers hosting, physical security and infrastructure controls. Those controls are Google's, and inherited.
Your data stays in South Africa
Data is stored in Google Cloud's Johannesburg region (africa-south1). The database and the application run there, and employee personal information is processed there, including HRIS syncs.
The scheduler that starts timed jobs runs in Europe, because Google offers none in Africa. It carries no personal data: it sends an empty trigger to the South African service, which does the work there.
Services that process content outside South Africa are named and disclosed under POPIA section 72, and each is off until your organisation accepts the cross-border position. SeeSub-processors and AI and your data.
Each organisation kept apart
Each organisation has its own andteam address, for example meridian.andteam.com. Sessions are bound to one organisation, and every request is checked against it. Writes happen on the server only, with browser access closed in the database rules. Data is encrypted in transit and at rest.
andteam staff reach an organisation only by assuming it, as an audited session, and every assume, refusal and end is written to that organisation's own audit trail.
Sign-in
Staff sign in with their work email or your single sign-on: Microsoft Entra ID, Google or any OIDC provider. Console logins are allowed only on your organisation's approved email domains, never a personal address. New starters sign in with a one-time link to their personal email until their start date. Access ends on the last day.
People see only what their role allows
Each administrator has one role, scoped to the organisation, a territory or chosen companies. Pay, bank, identification, employment equity and medical documents are protected areas, each granted separately. People in protected groups, such as executives or HR staff, are visible in full only to roles granted that group. An administrator can only invite someone into a role and scope at or below their own.
Approvers see what they are routed to approve, only while it is their turn. Every change to a record, every approval and every signature is recorded with who, what and when, and every view of a medical certificate is logged.
Special personal information
Employment equity data is held apart from the rest of the record and seen only by people granted it. Health information never goes to the AI. Medical aid health answers are used once and never stored. Medical certificates are seen by HR only, never by managers or payroll. Survey answers are anonymous by default, and results for groups smaller than five are hidden.
Tools for your Information Officer
Your organisation names its Information Officer, with an override per company. Retention periods are set per category of information, never below the legal minimum. Each month andteam prepares a due-for-deletion list per company, and nothing is deleted until the Information Officer approves the batch. Deletion runs 7 days after approval and can be cancelled until then.
Employees download what they can already see about themselves at any time. Requests for anything beyond that, and correction requests, go to the Information Officer's queue on a 30-day clock, and every request and its outcome is logged.
How andteam is built
Every change passes an automated gate and review before it merges, with branch protection on the main branch, dependency and code scanning in CI, and security headers on every response.