Security
Learn how Datar protects your data, manages access, and maintains a secure platform for your organisation.
Your data is protected
Datar is built on enterprise-grade infrastructure with security at every layer. Your data is encrypted at rest and in transit, access is controlled through fine-grained permissions, and the platform is continuously monitored for threats. We follow industry best practices to ensure your organisation's information remains confidential, intact, and available when you need it.
Data protection
How your data is stored, encrypted, backed up, and isolated
Encryption at rest
All data stored on the platform is encrypted using industry-standard AES-256 encryption. This includes files in encrypted cloud storage, managed database records, and all backup copies. Encryption keys are managed by the cloud provider's key management service and are rotated automatically on a regular schedule.
Encryption in transit
All communication between your browser and the platform uses TLS 1.2+ encryption. API calls, file uploads, and real-time updates are all transmitted over encrypted channels. We enforce HTTPS on all endpoints and automatically redirect any unencrypted requests.
Regular backups
Your data is backed up continuously with point-in-time recovery capabilities. Backups are performed automatically and stored in geographically separate locations for resilience. Our recovery time objective (RTO) is under four hours, with a recovery point objective (RPO) of under one hour, meaning minimal data loss in the unlikely event of a failure.
Tenant data isolation
Each organisation's data is logically isolated at the database level. Strict access controls ensure that one organisation's data can never be accessed by another tenant, even though the platform serves multiple customers. Every query is scoped to the requesting organisation, and cross-tenant access is architecturally prevented by the data layer.
Access controls
How access to your data is managed through authentication, roles, and item-level permissions
Datar uses a layered approach to access control, ensuring that only authorised people can see and modify your data. Access is enforced at three levels: platform authentication, role-based access within your organisation, and item-level permissions on individual files, projects, and requests.
Authentication
Users must authenticate with a verified email address and password. Passwords are hashed using industry-standard algorithms and are never stored in plain text. Session tokens are securely managed, expire after a period of inactivity, and are invalidated on logout. Failed login attempts are rate-limited to prevent brute-force attacks.
Role-based access
Your administrator assigns roles that determine what each user can access across the platform. Common roles include Employee, Manager, HR Admin, and System Admin. Roles control which modules, settings, and administrative functions are visible and available to each user.
Item-level permissions
Each file, project, request, and other item has its own permission settings. You control exactly who can view, comment, edit, or manage each item you create. When you share an item, the recipient receives only the access level you specify — and you can change or revoke it at any time.
Audit logging
All significant actions are logged with timestamps and user information. Administrators can review the activity history on any item to see who accessed, modified, or shared it. Audit logs are retained for compliance purposes and cannot be modified or deleted by users.
Permission levels explained
When sharing an item, you assign one of five permission levels. Each level includes all the capabilities of the levels below it:
Viewer — Can open and read the item but cannot make any changes. Ideal for stakeholders who need visibility without the ability to edit.
Commenter — Can view the item and add comments or annotations, but cannot modify the content itself. Useful for reviewers and collaborators providing feedback.
Editor — Can view, comment, and modify the item's content. Editors can update fields, upload new versions, and make substantive changes, but cannot delete the item or change its sharing settings.
Admin — Has full editing capabilities plus the ability to manage sharing settings, add or remove other collaborators, and configure item-level preferences. Admins cannot delete the item.
Owner — Has complete control over the item, including the ability to delete it permanently, transfer ownership, and override any other permission settings. Every item has exactly one owner.
Infrastructure security
The platform infrastructure that keeps your data safe and available
Cloud hosting
Datar is hosted on Amazon Web Services (AWS), which provides world-class physical security, network protection, and compliance certifications including ISO 27001, SOC 2, and CSA STAR. Data centres are staffed 24/7 with multi-factor physical access controls.
Network isolation
The platform runs in isolated network environments with firewalls and security groups that restrict access to only necessary services. Backend services are not directly accessible from the public internet. All traffic is routed through managed load balancers with DDoS protection.
Content delivery network
Static assets and the web application are served through a global content delivery network (CDN) with edge locations worldwide. This improves performance for users regardless of their location and provides an additional layer of DDoS mitigation at the network edge.
Auto-scaling
The platform automatically scales compute and database resources in response to demand. This ensures consistent performance during peak usage periods and prevents service degradation when traffic increases unexpectedly.
Monitoring and alerts
Automated monitoring watches for unusual activity, error spikes, and performance anomalies around the clock. Security alerts are investigated and addressed promptly by the operations team. Structured logging ensures that operational events are traceable and auditable.
Uptime commitment
Datar targets 99.9% platform availability. Planned maintenance windows are communicated in advance and scheduled during off-peak hours. In the event of an unplanned outage, the operations team follows established incident response procedures to restore service as quickly as possible.
Compliance & privacy
How Datar handles privacy, regulatory requirements, and South African data protection law
POPIA compliance
As a South African platform, Datar is designed to comply with the Protection of Personal Information Act (POPIA). We process personal information lawfully, collect only what is necessary, and ensure that data subjects' rights are respected. Your organisation remains the responsible party for its data, while Datar acts as an operator processing data on your behalf in accordance with your instructions.
Data sovereignty
Data is stored in the cloud region configured for your organisation. For South African customers, this means your data resides within the Africa (Cape Town) region by default. This helps you meet local data residency and sovereignty requirements, ensuring that your organisation's information does not leave the jurisdiction without your explicit consent.
Right to erasure
In accordance with POPIA, data subjects have the right to request the deletion of their personal information. Upon receiving a verified erasure request, Datar will remove the relevant personal data from active systems and backups within 30 days. Administrators can initiate erasure requests through the platform or by contacting the support team.
Data privacy
Your organisation's data belongs to your organisation. Datar does not sell, share, or use your data for advertising or profiling purposes. Data processing follows your organisation's policies and the terms of our data processing agreement. We do not access your data except when necessary to provide the service or when required by law.
Retention policies
Deleted items go to trash and are retained for a configurable period before permanent deletion. Administrators can adjust retention periods to meet their organisation's record-keeping requirements. When data is permanently deleted, it is removed from all active storage and will be purged from backups within the normal backup rotation cycle.
Data export
Your organisation can request a full export of its data at any time. This supports data portability requirements under POPIA and ensures you are never locked in. Contact your administrator or the Datar support team for assistance with data exports.
Incident response
How security incidents are detected, managed, and resolved
Datar maintains a structured incident response process to handle security events swiftly and transparently. Our goal is to minimise impact, communicate clearly, and learn from every incident to strengthen the platform.
1. Detection
Automated monitoring systems, anomaly detection, and user reports are used to identify potential security incidents. Alerts are triaged by the operations team and escalated based on severity.
2. Assessment
Once an incident is identified, the team assesses its scope, severity, and potential impact. Incidents are classified as low, medium, high, or critical based on the nature of the data involved and the number of users affected.
3. Containment
Immediate steps are taken to contain the incident and prevent further exposure. This may include revoking compromised credentials, isolating affected systems, or temporarily disabling specific functionality until the threat is neutralised.
4. Communication
Affected organisations are notified promptly with clear, factual information about the incident, its impact, and recommended actions. For incidents involving personal information, notifications are issued within the timeframes required by POPIA and other applicable regulations.
5. Resolution
The root cause is identified and remediated. Fixes are deployed, affected systems are restored to normal operation, and any compromised data or credentials are rotated. The incident is formally closed once all remediation steps are complete.
6. Post-mortem
After every significant incident, a blameless post-mortem review is conducted. The team documents what happened, why it happened, and what changes will be made to prevent recurrence. Lessons learned are incorporated into platform improvements and updated security procedures.
security@datar.co.za immediately. Do not wait — early reporting helps us contain incidents faster.Security contact
How to report security issues
If you discover a security vulnerability or have concerns about the platform's security, please report it responsibly. We take all reports seriously and will respond promptly.
Send security reports to security@datar.co.za. Include detailed steps to reproduce the issue and any relevant screenshots or logs. Please do not include sensitive credentials in unencrypted emails.
Response time
We aim to acknowledge security reports within 24 hours and provide an initial assessment within 72 hours. Critical issues are prioritised immediately and escalated to the security team for urgent review.
Your responsibilities
Steps you can take to keep your account safe
Security is a shared responsibility. Here are things you can do to protect your account and your organisation's data:
Use a strong password
Choose a unique password that is at least 12 characters long and includes a mix of letters, numbers, and symbols. Do not reuse passwords from other services. Consider using a password manager to generate and store strong passwords.
Share carefully
Only share files and items with people who need access. Use the minimum permission level necessary — for example, give Viewer access if someone only needs to read a document. Review your shared items periodically and revoke access that is no longer needed.
Log out on shared devices
If you access Datar from a shared or public computer, always log out when you are finished. Do not save your password in shared browsers. Close all browser tabs to ensure your session is fully terminated.
Report suspicious activity
If you notice anything unusual — unexpected changes, unfamiliar logins, or suspicious messages — report it to your IT administrator immediately. Prompt reporting helps contain potential incidents before they escalate.
Frequently asked questions
Common questions about Datar's security practices
Yes. All data is encrypted both at rest and in transit. Data stored on the platform uses AES-256 encryption, and all network communication uses TLS 1.2 or higher. Encryption keys are managed by the cloud provider's key management service and rotated automatically. This means your data is protected whether it is being stored, transferred, or backed up.
No. Each organisation's data is logically isolated at the database level. Strict scoping rules ensure that every query only returns data belonging to the requesting organisation. There is no mechanism for one tenant to access another tenant's data, and this isolation is enforced architecturally rather than relying solely on application logic.
Data is stored in the cloud region configured for your organisation. For South African customers, this is typically the Africa (Cape Town) region, which means your data remains within the country. If your organisation requires a different region for data sovereignty or latency reasons, contact the Datar support team to discuss your options.
Datar follows a structured incident response process. If a breach involving personal information is confirmed, affected organisations and the Information Regulator (as required by POPIA) are notified within the legally mandated timeframes. The notification includes details of the incident, the data involved, and recommended steps for affected users. See the Incident response section above for the full process.
Yes. Under POPIA, you have the right to request access to your personal information held by Datar, as well as the right to request its correction or deletion. To exercise these rights, contact your organisation's administrator or email security@datar.co.za. Verified erasure requests are processed within 30 days, and data is removed from active systems and backups.
Did this page help you?
Your feedback helps us improve our documentation.