Security and privacy, in writing.

Our role under POPIA

Sentinel processes debtor personal information on behalf of the agency, which remains the responsible party. We operate as your operator, under a signed operator agreement that records the purposes of processing, the security measures required, and what happens to the data when the agreement ends.

The agency decides what is processed, for how long, and who may see it. Sentinel enforces those decisions technically — through access controls, retention schedules and deletion — rather than asking people to remember them.

What we process

Call recordings and their metadata: the agent, the dialler, the date and time. From the recordings, the transcription and the compliance findings derived from it. Debtor personal information — names, identity numbers, account references, amounts — is processed only to the extent it appears in those recordings, and only to produce the compliance analysis the agency commissioned.

Nothing processed for the agency is used to train or improve any model, and nothing is sold, shared or re-purposed.

Recording calls engages RICA — the Regulation of Interception of Communications and Provision of Communication-related Information Act, 2002. Whether a call may lawfully be recorded and processed is the agency’s responsibility; Sentinel processes recordings the agency is authorised to record.

Where data lives

Recordings, transcriptions and findings are stored with our cloud hosting and database providers. Transcription and scoring are performed by hosted AI inference services. Some of these services are hosted outside South Africa, so a call processed through them crosses a border in transit.

The full list of sub-processors and their hosting locations is provided with the operator agreement, before you sign. We do not currently offer an in-South-Africa processing option — if that changes, it will be published here.

Encryption

Recordings are encrypted in transit from the dialler (SFTP or S3 with TLS) and at rest in storage. Application traffic is TLS-only. Backups carry the same encryption as production data.

Access control

Access is role-based and least-privilege. A reviewer can play the calls in their queue and nothing else; an administrator can manage users; nobody gets a role wider than their job. Agent-level restrictions control which agents a reviewer may hear, so a team leader sees their own team and nothing beside it.

Authentication uses per-user credentials with strong password policy. There is no shared agency account.

Retention and deletion

Recording lifecycles follow the agency’s own policy, as written into the operator agreement. When a retention period expires, recordings and their derived data are deleted. On termination of the agreement, all customer data is returned or destroyed, with a certificate of destruction issued.

The audit trail

Every review decision and appeal is recorded with the actor and a timestamp — that record is the system of record for quality assurance. Playback- and export-level logging is committed in the operator agreement as a security measure, and its exact scope is stated there.

The audit trail is designed to be exportable — built to be handed to a regulator, not just to exist.

What we cannot yet claim

We are not currently certified against ISO 27001, SOC 2 or any local scheme, and we do not say otherwise. We will publish certifications here when they are achieved, with their scope. Until then, judge us by the operator agreement and the audit trail. We are open to a penetration test of your choosing, on terms agreed in writing.