Security & Compliance

🇿🇦

POPIA Compliant

Full compliance with the Protection of Personal Information Act 4 of 2013

🔐

TLS 1.3 + AES-256

All data encrypted in transit and at rest using industry-standard protocols

🏢

SA Registered Entity

Registered company, Reg. 2025/595463/07, Cape Town, South Africa

🔒

Tenant Isolation

Complete data isolation between customers — no cross-tenant access possible

👁️

Full Audit Trail

Every AI action logged, timestamped, and available for customer review

🤝

Human-AI Governance

No autonomous action on production systems without confidence threshold met

Data Security Architecture

TranscendAI is built on a zero-trust security model. Every component — from AI agent to customer dashboard — operates under the principle of least privilege. No component has broader access than it requires to perform its function.

🔑

Encryption

TLS 1.3 for all data in transit
AES-256 for all data at rest
SSH keys scoped per customer
API keys rotated on schedule
Secrets managed via AWS Secrets Manager

🏗️

Infrastructure

Hosted on AWS af-south-1 (Cape Town)
VPC isolation per deployment
Security group enforcement
No public endpoints by default
WAF on all customer-facing surfaces

👤

Access Control

Role-based access (RBAC) throughout
MFA required for all admin access
Principle of least privilege enforced
Customer data accessed by auth. staff only
Session timeout on inactivity

📋

Audit & Logging

All AI agent actions logged
Timestamped action audit trail
Customer-accessible logs available
Security event alerting
Log retention: 12 months minimum

🤖

AI Governance

Confidence scoring on every action
Configurable action thresholds
Human approval for high-risk actions
SSH access limited to approved commands
No arbitrary code execution

🔄

Incident Response

24-hour security incident notification
Defined escalation procedures
POPIA breach notification within 72 hours
Post-incident review process
Dedicated security contact available

AI Agent Permission Model

Every AI agent operates within a strictly bounded permission model. Agents cannot take actions outside their defined scope — even if instructed to by a user or a ticket.

Agent	What it CAN do	What it CANNOT do	Status
Linux Admin AI	Read logs, restart approved services, clear tmp files, run patch checks	Modify firewall rules, delete databases, access other tenants	Enforced
Windows Admin AI	Unlock AD accounts, check event logs, read GPO status	Modify domain policy, create admin accounts, access external systems	Enforced
DB Admin AI	Read query stats, create indexes, verify backups, check permissions	Drop databases, modify data, export bulk data, create superusers	Enforced
RDS Admin AI	Read CloudWatch, verify snapshots, check replica lag, read parameter groups	Delete instances, modify production configs without approval, cross-region access	Enforced
StealthAI Observer	Read-only access to ticketing system during observation period	Write, modify, or delete any ticket data during observation	Enforced

Company & Governance Information

TranscendAI is a product of Quantum Horizon IT Services (Pty) Ltd — a South African registered technology company with an active trading history and a founding team with 20+ years of enterprise technology leadership.

Company Registration

Quantum Horizon IT Services (Pty) Ltd
Reg. No. 2025/595463/07
CIPC registered, Cape Town, SA

Leadership

Founding Director: Charmaine Davids
Former VP, JPMorgan Chase
Former Senior SA, Amazon Web Services

B-BBEE Status

B-BBEE Level 1 Contributor
100% Black-owned
Affidavit on file (April 2026)

Intellectual Property

SA Provisional Patent 2026/03677
HorizonPlane platform technology
4 filed inventions

Banking & Payments

Payments via Stripe (PCI-DSS L1)
SA banking details available
on request for enterprise invoicing

Enterprise Contracts

DPA available on request
MSA templates available
NDA executed before technical disclosure

Compliance Roadmap

TranscendAI is committed to achieving internationally recognised compliance certifications. Our current status and roadmap:

Standard	Status	Target
POPIA (SA)	Compliant — implemented	Maintained ongoing
GDPR (EU)	Aligned — SCCs in place	Formal certification Q1 2027
ISO 27001	In progress — gap analysis done	Certification Q2 2027
SOC 2 Type II	Controls implemented	Audit Q3 2027
PCI-DSS	Compliant via Stripe	Card data not stored by TranscendAI
FSCA (SA Financial)	Engaged	Guidance obtained for FSP deployments

Enterprise Procurement Support

TranscendAI provides full support for enterprise procurement and vendor onboarding processes. The following documents are available on request:

📄

Available Documents

Data Processing Agreement (DPA)
Master Services Agreement (MSA)
Non-Disclosure Agreement (NDA)
Company registration certificate
B-BBEE Level 1 affidavit
POPIA compliance statement
Security architecture overview
Penetration test summary (on NDA)

🏦

Financial Services Deployments

FSCA regulatory guidance obtained
SARB compliance posture reviewed
Air-gapped deployment option available
AF-South-1 data residency (Cape Town)
On-premise deployment scoping available
Change management pack provided

Security & Compliance Enquiries

For vendor questionnaires, DPA requests, penetration test reports, or compliance documentation:

Email: info@transcendai.io

Phone: +27 82 530 4578

Quantum Horizon IT Services (Pty) Ltd · Reg. 2025/595463/07

12 Beach Estate Boulevard, Unit 209, Azure, Bloubergstrand, 7441, South Africa