Filaway Trust Center

Filaway processes personal data on behalf of industrial and agricultural operators across Africa and the Middle East. This page is the single source of truth for our security posture, subprocessors, compliance status, and responsible-disclosure channel.

Compliance status

  • POPIA - Operator processing terms available; Information Officer designated.
  • GDPR - Data Processor terms available.
  • SOC 2 - Not currently pursued.
  • ISO 27001 - On our roadmap; not yet started.

Subprocessors

NamePurposeHostingActive fromDPA
Populated by super-admin.

Data residency

Primary data residency: EU (AWS eu-west-1, Ireland). All production data, including daily backups and point-in-time recovery snapshots, is retained in this region. Regional residency roadmap: per-tenant residency is declared in our tenant record today and is being extended to enforced, per-data-class pinning. Customers with a statutory localisation requirement -- including Zambia under the Data Protection Act 3 of 2021 -- should discuss residency with us before onboarding; we will not represent a pinning capability we have not built.

Encryption

Data in transit uses TLS. Data at rest is encrypted by our infrastructure provider (Supabase on AWS).

SLA

Uptime and maintenance-notice terms are set per contract on paid tiers.

Penetration test

Independent security testing: a third-party penetration test is scheduled and not yet complete. We will publish the attestation letter when it is.

Request NDA access

Responsible disclosure

Report vulnerabilities to security@filaway.com. See our security.txt for PGP keys and safe-harbour terms.

Contacts

Security enquiries: security@filaway.com · Privacy enquiries: privacy@filaway.com