Trust, written down.
You trust Sigalix and its platforms with your sales, your students and your customers. This page sets out how we protect that data, what we have in place today, what we do not have yet, and how to hold us to it.
What we do every day, by default.
These controls apply to every Sigalix platform and to every client system we host or support.
Access on a need-to-know basis
Named accounts with only the rights each role needs, two-step sign-in for administrators, no shared passwords, and access removed the day someone leaves.
Encryption in transit and at rest
All traffic travels over HTTPS. Cloud databases and backups are encrypted on disk, and passwords are stored only as salted hashes.
Reviewed, tested code
Every change is reviewed by a second engineer before release, tested against common web weaknesses, with third-party components kept up to date.
Audit trails you can read
Sensitive actions are recorded with the user, the time and the detail. Customers can see their own logs.
Offline does not mean unprotected
Data stored on a device or an on-site computer sits behind the same role-based permissions as the cloud.
People who know the rules
Everyone at Sigalix signs a confidentiality agreement and is trained in handling customer data before getting access to it.
Your data is yours. Here is where it lives.
Sigalix processes personal data in line with the data protection laws that apply to each client, including Cameroon’s Law No. 2024/017 of 23 December 2024 and the EU’s GDPR wherever we handle data about people in Europe.
- Ownership
- You own the data you put into our systems, and you can export it at any time in common formats.
- Location
- Platforms and client systems run with established cloud providers, and some keep a local copy on site. The hosting region is named in every contract.
- What we never do
- Sell your data, use it for advertising, or share it with outside AI services without your written agreement.
- Retention & deletion
- Data is kept only as long as the contract and the law require. When a contract ends you receive a full export, and we delete our copies on request.
- Your rights
- Anyone whose data we hold can ask to see, correct or delete it. Write to info@sigalix.com with the subject “Data request”.
When something goes wrong, you hear it from us first.
Automatic backups
Encrypted, stored apart from the live system, with restores tested on a schedule.
Monitoring
Hosted services are watched around the clock and alert an engineer when something fails.
Breach notification
If an incident affects your data, we tell you within 72 hours of confirming it.
Post-incident report
A plain-language account of the cause and what changed so it does not happen again.
Compliance, including what we do not have yet.
Procurement teams deserve a straight answer, with no badge we have not earned.
| Framework | Status | What that means |
|---|---|---|
| Applicable data protection laws | Applied | Policies, contracts and products follow the principles of the laws that apply to each client: lawful basis, limited purposes, security and individual rights. |
| EU GDPR | Applied where relevant | For data about people in the EU we sign a data processing agreement based on GDPR terms. |
| ISO/IEC 27001 | Not certified | Our controls are modelled on the standard. Certification is on our roadmap; we will publish the date once an audit is booked. |
| SOC 2 | Not held | We complete security questionnaires in full and walk your team through our controls on a call. |
| PCI DSS | Out of scope | We do not store card numbers. Card and digital payments are handled by licensed payment providers. |
Found a weakness? Thank you. Tell us first.
If you believe you have found a security problem in sigalix.com or any Sigalix platform, write to info@sigalix.com with the subject “Security report”.
Send a security reportWhat Sigalix promises
- We confirm receipt within two working days.
- We keep you updated until the issue is fixed.
- We will not take legal action against good-faith research within these rules.
- With your permission, we credit you once the fix is live.
What we ask
- Give us reasonable time to fix the issue before telling anyone else.
- Do not access, change or delete data that is not yours.
- No denial-of-service testing, spam, physical attacks or social engineering.
Request the security pack.
Everything a buyer’s IT or legal team usually asks for, sent within two working days, under a confidentiality agreement where needed.
Request the pack- Security overviewPDF
- Data processing agreement templateDOCX
- Hosting and service providersPDF
- Backup, continuity and incident policyPDF
- Your security questionnaire, completedOn request