From policy to control
Most IT policies say what should happen. An auditor needs to know who does what, how often, and what evidence it leaves. Rewriting our policies into that shape changed more than their format.
Trust & Security
Trust, Security & Data Protection
Independently assured (annual ISAE 3402), POPIA & Mauritius DPA aligned, data deployed where it needs to live, and built on Microsoft Azure.
Trust you can verify
Independently verified every year
Enterprise and public-sector customers need evidence that their data is safe. This is ours. Our solutions rest on a disciplined, independently-assured control environment, a privacy-by-design approach to personal data, your choice of where the data lives, and a Microsoft Azure foundation. Here is exactly how.
Four pillars
How we protect your data
Independently assured, ISAE 3402
Every year we undergo an independent ISAE 3402 assurance engagement covering our general IT control environment: the controls that govern system access, change management and IT operations. The report is available to qualified customers under NDA.
Data protection: POPIA & the Mauritius DPA
We design and operate in line with the data-protection laws of the markets we serve: POPIA in South Africa and the Data Protection Act in Mauritius. In practice: lawful, purpose-limited processing, data minimisation, defined retention and respect for data-subject rights, with privacy considered from the design stage.
Data sovereignty: where your data needs to live
Hosting and residency are agreed per engagement: we can deploy on your premises, within your own cloud tenant, or in an environment we host in a chosen Azure region, keeping South African data in South Africa, and handling Mauritian data in line with local requirements. You retain ownership and control of your data throughout.
A secure foundation, built on Microsoft
Our solutions are engineered on Microsoft Azure and the wider Microsoft ecosystem, and we hold Microsoft partner designations that reflect assessed capability and standing. Building on Azure means your solution sits on a platform that carries extensive, independently-audited security and compliance certifications.
For procurement & risk
What this means for you
The questions procurement and risk teams ask, and how this answers them.
- Is your control environment independently assured?Yes: an independent, annual ISAE 3402 over our general IT controls.
- Do you respect our data-protection obligations?Yes: POPIA and the Mauritius Data Protection Act, by design.
- Where will our data be hosted?Where you need it: on your premises, in your own cloud tenant, or in an environment we host in a chosen region. South African data stays in South Africa.
- Is the foundation secure?Microsoft Azure, with our Microsoft partner credentials and Azure’s audited platform certifications.
- How do you govern your use of AI?Under a formal Responsible AI Use Policy: human accountability, a zero-exposure rule for confidential data, and POPIA alignment.
The ISAE 3402 report and further assurance documentation are available to qualified customers on request, under NDA.
Governance policies
Our governance policies
The formal policies that underpin how we use AI in client engagements and how we handle personal data. Both are provided in full on request.
Responsible AI Use Policy
Our Responsible AI Use Policy governs every use of AI in a client engagement, from a coding assistant to an agentic tool. Version 2.0 took effect in July 2026 and aligns the programme to the Microsoft Responsible AI Standard, ISO/IEC 42001, the NIST AI Risk Management Framework and the King V Report on Corporate Governance, alongside POPIA and the Mauritius Data Protection Act 2017. It is owned by the company directors, approved by the CEO and reviewed every six months.
The policy sets out eight principles (accountability, fairness, inclusiveness, privacy, transparency, human oversight of automated decisions, security and validity), the Zero Exposure Rule for client data, additional controls on agentic tools in client environments, the standard Client AI Disclosure we provide when AI materially contributed to a deliverable, our governed model and tool registry, and the incident-reporting process.
Read the full summary on our Responsible AI page → The policy document itself is client-facing and is provided on request.
AI-assisted engagement and delivery
AI carries the work between the conversations across our engagement, requirements and delivery model, and a named nVisionIT person owns every commitment we make. No AI-generated artefact reaches a client without review and approval by a named engineer or consultant. See how we deliver with AI →
Our full Privacy & POPIA Compliance policy sets out how we collect, process, safeguard and dispose of personal information.
From our Insights
What we have learned doing this work
Write controls for the estate you have
A control document drafted from good intentions describes a better-run organisation than the real one. The review that matters most is the one done by the people who operate the systems.
Getting ready for TISAX when your customer requires it
For many automotive suppliers a TISAX label is a condition of trade. What a readiness baseline found, and why the gap is usually between a control being designed and a control being switched on.
Talk to us about your security & compliance requirements
We’re happy to walk your security, risk and procurement teams through our controls, data-protection approach and hosting options.