™Public Trust Resource
Trust and Compliance Positioning
Dootsa maintains a compliance-aligned, evidence-driven security and privacy program. This page describes current framework positioning and approved external language for enterprise, government, and election-body reviewers.
Civic outreach is district-scoped (province, municipality, ward) — not individual-targeted.
Location-verified surveys and election POC flows are non-voting feedback systems.
External code review uses Tier 1 evidence bundles by default; Tier 2 read-only repo requires dual approval.
Verified certifications and posture summary available via public compliance APIs.
ISO/IEC 27001 ISMS certification pursued via SANAS-accredited bodies (SANS-adopted standards); 27701 and 27017/27018 phased thereafter.
Machine-readable posture: /api/public/compliance/posture · Audit intake templates
Dootsa self-assesses as conforming to WCAG 2.2 Level AA for priority public, authentication, and survey-participation journeys after keyboard/NVDA-oriented remediation (including matrix, ranking, pin tours, and remaining question controls). This is not a third-party certification. Admin, staff, and creator consoles remain best-effort. Report issues via the accessibility contact path.
Interactive types audited 2026-08-06: matrix, ranking, pin_tour. Last reviewed 2026-08-06. Feedback: contact accessibility support.
POPIA
Operator controls for purpose limitation, data minimisation, security safeguards, and auditable disclosure through least-privilege evidence grants.
PAIA
Public Manual of Information for access to company records, handled by the Information Officer with prescribed forms, fees, and Information Regulator remedies.
SOC 1
Not currently attested. SOC-style governance and control evidence can be shared for risk review.
SOC 2
Not currently attested. We operate a SOC 2-aligned control program with readiness artifacts and evidence collection.
ISO 27001
ISO 27001-aligned ISMS with documented scope, SoA, and risk register. Certification pursued via SANAS-accredited body; verified status on this page when complete.
ISO 27701 / 27017 / 27018
Phased roadmap after 27001: privacy extension (27701) and cloud SaaS controls (27017/27018). SANS-adopted equivalents apply in South Africa.
PCI-DSS
Not currently certified/attested. PCI obligations are managed based on cardholder-data scope and contractual requirements.
HIPAA
Not operated as a HIPAA-covered production environment by default. HIPAA mode is enabled when PHI scope and BAAs are formally in place.
EU Model Clauses (SCCs)
Supported through SCC legal workflows and transfer safeguard documentation, subject to signed agreements.
Evaluating Dootsa for procurement? See Dootsa for Businesses and the audit request templates. Enterprise pack: enterprise readiness brief. Certifications API: /api/public/compliance/certifications. Questions? Contact support.