SECURITY STATEMENT

This Security Statement should be read in conjunction with MyHelper's Terms of Service, Privacy Policy, and POPIA Compliance Statement.

MyHelper (Pty) Ltd, Registration Number: 2024/106630/07, is committed to protecting your data against unauthorised access, misuse, and disclosure—both while in transit and at rest on our systems. We align with, and in many areas exceed, the standards required by South Africa's data protection laws, including POPIA. Below is a breakdown of our core data protection controls:

Protection of Data in Transit

All data transferred between your browser and MyHelper's servers is encrypted using SSL (Secure Socket Layer) certificates. This is the same level of encryption used in online banking, ensuring that third parties cannot eavesdrop or tamper with your data in transit.

Our Data Hosting and Security

MyHelper's backend systems are hosted via Supabase, which leverages Google Cloud Platform (GCP) in ISO-certified data centres. Our frontend and edge infrastructure are managed via Vercel's globally distributed content delivery network (CDN) and serverless environment.

All user data on the MyHelper platform is stored and processed securely in high-performance cloud infrastructure with enterprise-grade security protocols. These systems implement:

• End-to-end encryption for data at rest and in transit (TLS/HTTPS),
• Firewalled environments with layered security controls,
• Strict access management, limited to authorised technical personnel,
• Continuous monitoring, automated backups, and system redundancy.

Our infrastructure providers comply with globally recognised standards such as ISO 27001, SOC 2, and GDPR, ensuring your information is managed in line with international best practices for privacy and data protection.

High Security Standards

MyHelper's system is built using security-by-design principles:

• We follow OWASP (Open Web Application Security Project) standards.
• All software updates are reviewed for compliance with secure coding guidelines.
• Role-based access controls are enforced internally, ensuring that employees only access data essential to their role.
• Logs are maintained for privileged account activity.
• Our platform is protected against common vulnerabilities such as SQL injection and cross-site scripting (XSS).
• We regularly assess and update our security posture to match evolving threats and industry best practices.

Trusted Infrastructure

AWS, our infrastructure provider, holds certifications and accreditations such as:

• ISO 27001 (Information Security Management)
• ISO 27017 (Cloud Security)
• ISO 27018 (Cloud Privacy)
• SOC 1, SOC 2, SOC 3
• PCI DSS Level 1
• EU C5 (BSI's Cloud Computing Controls Catalogue)

These standards ensure that all information assets are protected across their global operations.

Availability and Confidentiality

MyHelper's system uses multi-AZ (Availability Zone) redundancy, meaning that in the unlikely event of a data centre outage, operations fail over seamlessly to a secondary site.

We monitor system health both automatically and manually. In addition:

• Data is backed up in real-time to secure, offsite locations.
• Passwords are stored using a one-way hash function. Even if our database were compromised, passwords remain unreadable.

Two-Factor Authentication (2FA)

To enhance login security, MyHelper offers two-factor authentication. This means logging in (or performing certain sensitive actions) requires both your password and a time-sensitive verification code. Even if your password were compromised, your account remains protected.

Personal Data Breach Process

In the unlikely event of a data breach, MyHelper will notify all affected parties without undue delay and in accordance with POPIA and applicable global standards. Our breach response protocol includes:

• Identifying and containing the breach.
• Investigating the scope and cause.
• Communicating transparently with users.
• Taking corrective steps to prevent recurrence.

Limitation of Liability

MyHelper (Pty) Ltd cannot be held liable in any way, shape, or form for any loss, damage, or claim—whether direct or indirect—arising from the use of or reliance upon the security controls and measures outlined above. Users remain responsible for the accuracy of their input and safeguarding their own credentials.

Questions?

If you have any security-related questions or concerns, please contact our Information Officer: