Privacy and data, in plain words

How Catalyst Platform looks after the information practices and their clients trust it with: where it is kept, where AI is used, what service providers see and when, and who can see what.

This is not legal advice. It describes how the platform is designed, written by ProteaByte (the builder) for Catalyst, its counsel and pilot practices. Every legal point is a question for counsel, listed at the end.

Where information is kept

The rule that comes before every other, once the move to Cape Town is complete: information that identifies a practice's client, or any person, is stored only in South Africa. It will live with Amazon Web Services in its Cape Town region, reached over private connections, and be encrypted with keys that are also held in Cape Town. Part of that setup is running already; the rest is designed and tested on our own machines.

Prod keeps some files in the EU for now. Catalyst agreed in October 2026 that the platform need not run fully in South Africa at first, to keep its cost low. Prod, the one hosted system, live since 14 October 2026, keeps its database and the books as read from Xero with Amazon Web Services in Cape Town. Reports, issued PDFs, information prepared for service providers and the locked copy of the audit trail are kept in Cloudflare's storage in the EU. The key that protects Xero connections and the signing keys are held as Cloudflare secrets instead of in Amazon's key service, so anyone with deploy rights on the Cloudflare account can read them. Keeping identified information in the EU is a cross-border transfer under POPIA. Prod holds real businesses' information; until 30 October 2026 its database, too, was in the EU, with Neon in Frankfurt. Catalyst's written confirmation of the arrangement, telling the pilot practice, and recording the transfer in the privacy impact assessment are still open. Moving the rest to Cape Town is a change of settings, with no change to the code.

Stays in South Africa (after the move to Cape Town)

Each client's books as read from Xero, and the tidied ledger made from them
Health scores, checks, findings and recommendations
Reports, drafts and issued PDFs. After the move the PDF is produced in South Africa as well; in prod today Cloudflare's browser service produces it.
Client consent records and the evidence behind them
The audit trail
The key that links the coded analysis copy back to a named business
Information prepared for a service provider, until it is delivered
The practice's Xero connection details, stored encrypted

Leaves South Africa, by design

Requests for AI wording, with no names or identifiers in them (see Where AI is used). They go to Anthropic in the United States through Cloudflare's AI gateway. Anthropic is the only provider set up. AI wording is switched off in prod today.
Cloudflare's own records of traffic to the dashboard: users' IP addresses, browser details and page addresses, which carry reference numbers but no names. Cloudflare can't keep these records in a chosen country.
Information passing through Cloudflare while it is worked on. Some background tasks, such as the nightly sync, may run in Cloudflare data centres outside South Africa. They handle information in memory and store none of it there.

Cloudflare runs the platform's code. In prod the code is placed next to the database in Cape Town, because pages are slow when every query crosses a long distance. Apart from the files kept in its EU storage in prod for now, Cloudflare stores no client information: what it keeps while background work runs is a reference number, never the information itself.
Xero holds the client's books in the first place, under the practice's or the client's own agreement with Xero. Catalyst Platform brings a copy into its own storage in South Africa.
Log files record reference numbers and codes only. Client names, figures and Xero's replies are never written to a log.
Nothing from a client's books is used to train any AI model. Xero's terms forbid it, and training is switched off in the AI provider's account before AI wording is turned on.
The demonstration system uses made-up data only.

Where AI is used, and where it isn't

AI writes some wording in the report. It never produces a number, a score, a finding or a decision.

	How it's done	AI involved?
Figures and ratios	Calculated from the client's books by fixed formulas	No
Health score and data reliability	Calculated by fixed rules and the practice's chosen weighting	No
Checks and findings	Standard tests with stated thresholds, reviewed by the accountant	No
Recommendations and their estimated effect	Standard actions with effect ranges and stated assumptions	No
Signals for service providers	Calculated from the client's books by fixed formulas. Never scored and never in the report	No
Service providers	The service provider's criteria, tested on the figures, signals and checks	No
Executive summary	Written by AI from the figures, or standard template wording	Wording only, if switched on
Why each recommendation matters	Written by AI from the figures, or standard template wording	Wording only, if switched on

Off until switched on. When the AI wording is off, every section uses standard template wording. It is off in prod today: no AI provider account is connected yet.
No names go to the AI. The request carries figures, ratios and changes, and calls the client "the business". It carries no business or person name, registration, tax or bank number, address, account name or free text from the books. Each request is checked before it is sent, and if the check fails, nothing is sent.
Every number is checked. Each number in the AI's wording must match a figure it was given, in the same unit. If one doesn't, the section is written once more; if it fails again, the template wording is used instead.
The name goes back in on Catalyst Platform's side. The client's name is put into the wording when the report is produced, on Catalyst Platform's own systems (in South Africa after the move to Cape Town).
The accountant reviews it all. Every part of the report is marked as AI wording, template wording or the accountant's own, and nothing reaches a client before the practice approves the report.
Cloudflare, which passes the request on, is set not to keep its content.

What service providers see, and when

Every service provider, such as Aurora Capital or ACC Consult, follows the same path. In the pilot a service provider sees nothing about a client until that client has consented to share named details with that service provider. Before consent, the service provider doesn't even learn that a client may fit.

Criteria are tested on Catalyst Platform's own systems. When a report is issued, the month's figures are copied into a separate analysis copy under a coded reference instead of the client's name. The service provider's criteria are tested on that copy. Only the consent step can link the copy back to a named client.
The accountant sees why. The client file shows that a service provider "may be a fit", with the criteria met (for an adviser, which of its opportunities matched), kept apart from the findings. A separate panel, "Signals for service providers", shows the facts those criteria can read about the client.
The accountant decides whether to raise it. Nothing happens unless the accountant presents the option to the client.
The client consents to one named service provider, one purpose and a listed set of details (see Client consent).
Catalyst staff review exactly what will be shared, client by client and detail by detail, before anything is sent.
Only those details are sent, by a method agreed with the service provider. Each delivery has its own reference number, so a service provider can't match records across deliveries. The service provider's offer comes back to the accountant, who presents it, and the client decides.

Service provider matches never change the findings or recommendations. Findings and recommendations are worked out without any service provider information.
A service provider only ever receives details the client has agreed to. If a detail isn't on the consent, it can't be sent.
Each service provider's criteria, the details it may receive and its consent purposes are set up in the service provider library by Catalyst staff. A second staff member approves each new version before it is used.
Once a service provider has received information, it handles it under its own responsibility and its agreement with Catalyst.

An advisor or partner records the client's consent in the client file. A consent is narrow by design: no "and affiliates", no groups of service providers and no open-ended purposes.

A consent records	For example
The service provider	One named service provider
The purpose	One named purpose, in wording approved by counsel
The details to share	A listed set, kept to the minimum the purpose needs. Nothing outside the list can be released.
The evidence	What the client was shown, which report version it was based on, the wording used, when, who gave consent and in what role, how it was given, and who recorded it
When it ends	An end date. Once it has passed, nothing more can be shared.

If anything is unclear, the answer is no

Before anything is shared, the platform checks for a valid consent each time. If there is no consent, if it has expired or been withdrawn, if a detail isn't on the list, or if the consent record can't be reached, nothing is shared. No setting, shortcut or staff override changes that.

Withdrawing consent

The client tells the practice (or the service provider) that it withdraws consent. The advisor records it in the client file.
From that moment nothing more is shared with that service provider for that purpose.
If details were already sent, Catalyst staff send the service provider a withdrawal notice to the service provider's named contact and record when the service provider acknowledges it.
The practice tells the client that withdrawing stops any further sharing but can't recall what was already sent. The service provider's agreement with Catalyst requires it to stop using the information once notified.

Who can see what

Each practice's information is walled off from every other practice's in the database itself, not only on the screen. A user who asks for another practice's records gets "not found".

Who	Sees	How they sign in
Partner	Everything in their own practice. Approves sensitive report content (going concern, tax, compliance), manages the team, and sees and can end access by Catalyst staff.	Email and password, plus a passkey
Advisor	Their practice's clients, findings, reports and service provider matches. Records or withdraws client consent.	Email and password, plus a passkey once they add one
Practice manager	Xero connections, account classification and client identifiers. Can read findings and service provider matches. Can't approve reports.	Email and password, plus a passkey once they add one
Read only	Clients and issued reports	Email and password, plus a passkey once they add one
Catalyst staff	No practice's client information. Sees practice health as counts only, with no client names or figures. Sets up practices, runs the service provider desk, the service provider library and the rule library. Never a user in any practice.	Email and password, plus a passkey
Catalyst staff in a practice	One practice, as Read only or Practice manager, for at most 4 hours and for a stated reason, with a visible banner. Every partner is told straight away, any partner can end it early, and everything they do is recorded.	As Catalyst staff
Service provider	Only the details a client consented to share with it	Doesn't use the dashboard
ProteaByte	Builds and supports the platform under contract, with no right to use client information for anything else, including training or other clients' work	—

Signing in lasts 8 hours of inactivity and 30 days at most, then the user signs in again.
To keep pages quick, a sign-in is re-checked at most every 5 seconds when someone only reads. A role change or a removed user therefore takes up to 5 seconds to reach pages they are reading. Every action is checked at once, and access by Catalyst staff is checked on every request.
Passwords are stored only in a scrambled form that can't be reversed.
Catalyst staff accounts are few and named. A platform administrator creates them outside the dashboard, and an email that belongs to a staff account can't be used for a practice user. The information officer is to review them every quarter; that is a procedure, and the platform doesn't enforce it.

The audit trail

Every change is recorded at the moment it happens, as part of the same step. If the record can't be written, the change doesn't happen either.

Recorded every time: Xero connected or disconnected; each sync; a finding approved, changed or dismissed, with the reason; a report approved and issued, with a fingerprint of its content; client consent given or withdrawn; information prepared for and sent to a service provider; every time the coded analysis copy is linked back to a named client; role changes; access by Catalyst staff; exports; refused attempts to see something.
Can't be edited or deleted. The database refuses changes to past entries, whoever asks.
Tampering shows. Each entry is chained to the one before it, so changing or removing any entry breaks the chain. The chain is checked every day and a copy is kept in locked storage: in South Africa after the move to Cape Town, in Cloudflare's EU storage in prod until then.
Kept for 7 years.

How long things are kept

These are the platform's working periods, for counsel to confirm (see the questions below).

Information	Kept for	Why
The books as read from Xero	7 years	Evidence of exactly what Xero returned
The tidied ledger	7 years	Financial record-keeping
Health scores, findings and recommendations	7 years	To explain advice that was given
Issued reports	7 years	Professional record
Draft reports	18 months	Working papers
Audit trail	7 years, unchangeable	Accountability under POPIA
Client consent records	7 years after the consent ends	Proof of the basis for sharing
Information prepared for a service provider	90 days	Kept only for its purpose
Sign-in records	90 days	—
The key linking the analysis copy to a named client	While the client is with the practice, plus 7 years	—

Requests from a client

The client asks to	What happens
See its information	An export of what the platform holds about it, with its consent and sharing history
Correct something	It is corrected in Xero and read again. The platform doesn't edit the client's books.
Stop service provider sharing	Consent is withdrawn (above), and the client is left out of anything shared later
Be deleted	The key linking the analysis copy to the client is destroyed, so that copy can never again be tied to it. The accounting record itself is kept for the period the law requires for financial records.

Questions for counsel

ProteaByte has prepared a draft privacy impact assessment for counsel with the full facts. These are the questions in it, in plain words, plus one about prod's storage in the EU that the assessment doesn't cover yet. None of them is answered here.

Topic	The question
Who is responsible for what	The role under POPIA of the practice, Catalyst, the analysis copy, the service provider service and each service provider
POPIA section 57	Does linking a client across systems by its registration, tax, VAT or PAYE numbers need the Information Regulator's prior authorisation? Does testing a client against a service provider's criteria count as "credit reporting"? If so, when should an application be made?
Consent wording	The wording the client is shown, the list of purposes a consent may name, and the service provider's own purposes
Withdrawal	Is it right that a withdrawal overrides every earlier consent for that client, service provider and purpose, and that two live consents for the same purpose are refused as unclear?
Testing service provider criteria	May a client be tested against a service provider's criteria before it has consented, or does that need consent first?
Customers and suppliers	May the names of a client's own customers or suppliers be shared with a service provider on the client's consent alone?
AI requests	Is a request carrying exact figures but no names "de-identified" under POPIA?
Information passing through Cloudflare	Is information handled in memory, and not stored, in a data centre outside South Africa a cross-border transfer? Cloudflare's data protection agreement doesn't name POPIA.
Prod's storage in the EU	Keeping identified information in the EU until the move to Cape Town is a cross-border transfer under POPIA section 72. What must be in place for a real practice's clients, and what must the practice and its clients be told?
South African storage	Is keeping identified information in South Africa a legal requirement, or our recommendation?
Retention	Which law supports keeping financial records for 7 years, and is 7 years proportionate for the contact details in the books as read from Xero?
Privacy notice	Text that tells clients about AI wording, consent-only sharing with service providers, that withdrawal can't recall what was sent, and how deletion works
Sensitive details in the books	A ledger line may mention, say, a person's medical aid. Does that incidental mention bring in POPIA's rules on special personal information?
Anonymised sharing	The anonymisation standard to use if service providers are ever shown anonymised groups of businesses instead of named ones

Questions for Cloudflare, to be answered in writing and attached to the assessment: where its AI service runs; where its records of AI requests, background work and stored results are kept, and for how long; whether its database connection service keeps copies of what it reads; whether it will sign a POPIA operator agreement; and whether background tasks can be kept in South Africa.