Gelezanathi is in development. This page describes security principles and planned controls; it is not a claim that an operational school-data platform is available.
Data is encrypted in transit between a browser and our servers, and at rest in our database and file storage. A learner's results are never sent or stored in plain text.
Backup and recovery arrangements for a future live platform must be implemented, tested and documented before school or learner data is processed.
Role-based and school-scoped access are design requirements for the future platform. They should not be interpreted as a verified live control at this development stage.
Accounts are protected by email and password authentication with secure session handling. Multi-factor authentication for staff accounts is on our near-term roadmap.
Hosting, reliability and incident-response arrangements must be verified and documented before a live school service is offered. We don't publish an uptime figure we haven't earned.
Sensitive actions — grade changes, data exports, permission changes — are logged so a school can see who did what, and when. This is an area we're actively building out as we onboard schools.
If something goes wrong, we investigate immediately, contain it, and tell affected schools directly and plainly — not through a press release, and not after the fact.
Found a vulnerability? Email security@gelezanathi.co.za and we'll acknowledge it, investigate, and keep you posted until it's resolved.
We don't hold ISO 27001 or SOC 2 certification today. As we scale across more schools, formal, independently audited certification is on our roadmap — see the note below.
Gelezanathi is an early-stage platform. We have not been independently audited for ISO 27001, SOC 2, or any other formal security certification, and we won't claim otherwise. What we've described above reflects how the platform actually works today. Where a control is still being built, we've said so — and we're glad to walk any school's IT lead or governing body through our real architecture, not a marketing version of it.
A school owns its data. We collect what the platform needs to assess and support learners — nothing more — and we're building the platform's data handling around POPIA from the ground up, not retrofitting it later. A full privacy policy detailing retention, export and deletion rights is coming as part of our legal documentation, alongside this security page.