POPIA-aware architecture. Honest about the gap.
We don't claim 'POPIA Compliant' as a marketing badge — that requires formal certification we don't have. What we do have is a security architecture that gives you the technical controls POPIA demands. Here's exactly what's in the system, and what's still your firm's responsibility.
What we have: LexPrime OS implements the technical measures POPIA Section 19 requires — role-based access control, audit logging (Section 30 access requests), 2FA, encrypted password storage, SA data residency, and local AI inference (no client data sent to external APIs).
What we don't have: Formal POPIA certification from the Information Regulator, a built-in Data Subject Access Request (DSAR) workflow, automated breach notification (Section 22), a retention schedule enforcement engine, or a designated Information Officer field on the firm settings model. These are on our roadmap.
What is your firm's responsibility: Appointing an Information Officer (Section 17), drafting a PAIA manual, defining retention periods, training staff, and notifying the Regulator in the event of a breach. Our compliance AI tool can audit your documents for gaps, but the policies are yours to own.
We chose honesty over a marketing badge. If a vendor claims "POPIA Compliant" without certification, ask to see the certificate. If they can't produce it, they're either ignorant or dishonest.
10 security features — verified in source code
Every control below is implemented and tested. The implementation column tells you exactly how — no vague "bank-grade security" claims.
TOTP, SMS, email, and backup codes. Session tracking with device and IP logging.
Implementation:
Real crypto-random TOTP secrets, 10 backup codes per user, active session list.
Client identification, document verification, PEP screening, risk rating.
Implementation:
Full FICA record model with verification workflow and audit trail.
Send documents for signature, track signing status, store signed copies with audit trail.
Implementation:
SigningRequest model with multi-party signing and IP/timestamp capture.
Every user action is logged — who, what, when, from where. Essential for POPIA Section 30 access requests.
Implementation:
AuditLog model populated across all critical write endpoints.
Automatic tracking of SA's 3-year prescription periods — never lose a claim to prescription again.
Implementation:
PrescriptionAlert model with automated deadline checking.
Six-tier hierarchy (Super Admin → Managing Attorney → Attorney → Paralegal → Receptionist → Viewer) with per-module granularity.
Implementation:
Role matrix enforced in both UI sidebar and API endpoints.
Trust and business account separation, Section 35(4) certificates, reconciliation batches.
Implementation:
TrustTransaction + ReconciliationBatch models with LPA Section 35 references in code.
Link bank accounts, import transactions, auto-reconcile against trust entries.
Implementation:
BankAccount + BankTransaction + ReconciliationBatch models.
All client data stays on South African infrastructure. AI inference runs locally via Ollama — your client files never leave SA jurisdiction.
Implementation:
Self-hosted VPS in Johannesburg + local Ollama instance (no external API calls for AI).
Minimum 8 characters, requires uppercase, lowercase, and numeric. Bcrypt hashing with 12 rounds.
Implementation:
Server-side validation + bcrypt hash with cost factor 12.
System requirements — what you actually need
We don't pretend AI features work on any hosting. Here's what you need for full functionality.
- South African VPS (4GB RAM minimum for AI features)
- Recommended: 8GB RAM for firms with 5+ concurrent users
- 20GB disk space (plus document storage)
- Ubuntu 22.04 LTS or equivalent Linux
- Ollama installed on the same server (we provide setup script)
- Recommended models: granite3.1-moe:3b (default) or llama3.2 (3B params)
- AI features gracefully degrade — system remains fully functional without Ollama
- 4GB+ RAM allocated to Ollama for responsive inference
- Modern browser (Chrome 90+, Firefox 88+, Safari 14+, Edge 90+)
- JavaScript enabled
- WebRTC support for voice dictation
- PayFast merchant account for credit card payments
- WhatsApp Business API account for client messaging
- Email account (IMAP/SMTP) for unified inbox
- Bank feed access for reconciliation
On our compliance roadmap
These features are not yet in the system. We're telling you that upfront.
Data Subject Access Request (DSAR) workflow
Q3 2026Self-service portal for data subjects to request their data under POPIA Section 23.
Automated breach notification
Q4 2026Section 22 breach detection and notification to the Information Regulator within 72 hours.
Information Officer designation field
Q3 2026Built-in field on firm settings to record the appointed Information Officer per Section 17.
Retention schedule enforcement
Q1 2027Automated archival and destruction of data based on configurable retention periods.
Formal ISO 27001 certification
2027Independent audit and certification of our information security management system.