Live in the current platform.
Trust Centre
How GovFin earns
your confidence.
Verification only works when the handling behind it is careful and accountable. This page explains our approach in plain language and states honestly where each control stands today.
Status key
We label maturity, not marketing.
Every item below carries one of these states so nothing is implied to be further along than it is.
Actively being built or hardened.
Committed on the roadmap, not yet started.
Drafted, pending qualified South African review.
Controls
What we do with your information.
Implemented
Secure document handling
Supporting documents are stored outside the public web directory with opaque filenames, integrity hashing and authorised-only download.
Implemented
Access control
Client users see only their organisation's requests; staff and auditor roles are separated with negative tests.
Implemented
Transport security
Security headers, HSTS on secure requests, framing denial and content-type protections are applied.
In progress
Audit logging
Material workflow and document actions are recorded; tamper-evident chaining and broader coverage are being extended.
In progress
Malware scanning & promotion
An integrated scan-then-promote pipeline is being built; real documents are not processed until it is operational.
Under legal review
Consent & privacy notices
Versioned consent records and candidate notices are being drafted for qualified South African legal review.
Regulatory framework
Information Regulator South Africa
Understand the POPIA and PAIA oversight context. The Regulator is not presented as a verification source or GovFin partner.
Read regulatory guidance →Responsible use
People stay in the process.
Automation helps us work consistently; it does not replace judgement.
- Material findings are reviewed by a person before a result is released.
- A flagged item is never treated as an automatic decision about a candidate.
- Candidates can seek access to, and correction of, information held about them.
- Reports are released under authorisation, not left implicitly approved.
Questions about our controls?
Ask the GovFin team directly.
We would rather answer a specific question than publish a vague assurance.