Data Residency & POPIA
Where your data actually lives
We don't carry a SOC 2 or ISO 27001 badge — this page is the honest alternative: what we actually do with your data, in plain language.
Hosted in South Africa
Our application servers and databases run on our own network in Centurion, Gauteng — not a rented slice of an overseas cloud region.
We don’t sell your data
Customer information is never sold or rented to third parties, and it never leaves the systems that exist to deliver your service.
Access is scoped by role
Staff only see what their role needs, and customer-facing accounts are scoped to that customer’s own records.
Retention has limits
Where we hold sensitive data purely to deliver a feature, we purge it automatically once it’s past its useful window — not forever.Where your data lives
The application servers and databases behind this site, and the rest of the Telecloud platform, run on infrastructure we operate ourselves — on our own network, based in Centurion, Gauteng, South Africa. Your account, billing and service data is not routed out to a foreign cloud region as a matter of course; it stays on servers we control, in the same country you signed up in.Who can access it
Every staff login carries a role, and each role is limited to a defined set of systems — a salesperson’s account and an accounts-team account don’t see the same things. Where customers and resellers have their own portal login, that login is scoped so it can only read and write that account’s own records, not anyone else’s. Our support chat tooling runs on infrastructure we host ourselves, rather than being outsourced to a third-party SaaS provider that would otherwise hold a copy of every conversation.What we do — and don’t — do with your data
We do
Use your data to provision, bill and support the services you’ve signed up for
Restrict staff access by role — a salesperson’s login and an accounts login see different things
Scope customer/reseller portal logins to that account’s own records only
Run our support chat tooling on our own infrastructure, not a third-party SaaS inbox
Include a working unsubscribe link on every bulk/marketing email we send
Automatically purge AI Call Center recordings and transcripts once their retention window ends
We don't
Sell or rent your personal information to data brokers or marketing lists
Hand your customer data to a third party for that party’s own marketing purposes
Host your data on infrastructure outside South Africa by default
Give every staff member blanket access to every customer’s records
Keep AI Call Center recordings indefinitely — they’re purged on a set schedule
POPIA principles we apply in practice
We are not formally POPIA certified — there is no official third-party certification scheme for POPIA the way there is for ISO 27001. What we can show you instead is how a few of its core principles show up in how our systems actually behave.Purpose limitationData collected to deliver a service (billing, support, provisioning) is used for that service — not repurposed for something you didn’t sign up for.
Storage limitationAI Call Center call recordings and transcripts carry a retention window — 90 days by default, configurable per agent — after which the recording and the PII-bearing transcript are purged automatically by a daily background job. Aggregate call outcomes (score, duration) are kept so reporting still works; the sensitive content isn’t.
Access controlEvery login carries a role, and roles carry an explicit list of which parts of the system they can touch. On sites with customer accounts, every read and write is additionally scoped to that customer’s own records — enforced in the API, not just hidden in the interface.
Direct marketing consentBulk emails we send carry a real unsubscribe link, and an opt-out is honoured immediately — not queued for a future batch.
What this page isn'tThis isn't a SOC 2 report, an ISO 27001 certificate, or a HIPAA attestation — we don't hold any of those, and we won't claim otherwise. It's a plain description of how we actually handle data today. If your own compliance process needs something more formal — a due-diligence questionnaire, a specific written answer — get in touch and we'll work through it with you directly.
Questions about how we handle your data?
Talk to us directly — we'd rather answer the question than leave you guessing.Contact Us