We sell security, so the bar for what we say about our own is higher than the bar for what we say about yours. This page describes the controls we actually run, which SOC 2 criteria they map to, and — just as importantly — what we have not been attested for.
SOC 2 is not a certification you can award yourself. It is an attestation issued by a licensed CPA firm after examining your controls — Type I at a point in time, Type II over an observation window of three to twelve months.
Each control below is in production today. The criteria references are where that control would be examined in a SOC 2 engagement.
Administrative access requires multi-factor authentication. Service identities hold least-privilege roles scoped to the single resource they need. Our mail sender uses short-lived delegated tokens with one narrow scope — there are no long-lived service-account keys to leak.
CC6 · LOGICAL ACCESSWe monitor our own infrastructure with the same SOC platform we operate for clients: log ingestion, detections mapped to MITRE ATT&CK, and alerting into an on-call channel. Edge traffic from our WAF is fed into it, so attacks against this site are detected by our own tooling.
CC7 · SYSTEM OPERATIONSWe scan our own estate with the same licensed Tenable Nessus Professional engine we sell, on the same cadence we recommend to you. Findings are ranked and remediated rather than filed. This is the control we would be embarrassed to get wrong.
CC7.1 · VULN DETECTIONEverything is served over TLS with HSTS preloading, so browsers refuse to connect insecurely even on a first visit. Data is encrypted at rest by default on Google Cloud. Secrets live in Secret Manager and are never committed to source or written to logs.
C1 · CONFIDENTIALITYThis site runs a strict Content Security Policy with no inline or third-party script execution, plus frame-denial, MIME-sniffing protection and a restrictive permissions policy. Every input is validated server-side; prices are recomputed on our side and never trusted from the browser.
CC6.6 · BOUNDARY PROTECTIONWe are not currently accepting card payments. When we do, checkout is hosted entirely by our payment provider — card numbers are never transmitted to, processed by, or stored on Ntinga infrastructure, which keeps that data out of our environment by design.
PCI · SCOPE MINIMISATIONScan results, reports and customer records are processed and stored in Google Cloud's africa-south1 region in Johannesburg. We chose it so that POPIA data-residency questions have a short answer, and so that latency and jurisdiction both sit where our customers are.
Personal information processed in-country, with a defined lawful basis and retention.
Where EU personal data is involved, transfers and processing terms are addressed contractually.
Scan findings are yours. They are not shared, resold, or used to train anything.
Tell us and we will work with you. We publish a machine-readable policy at /.well-known/security.txt under RFC 9116. We do not pursue researchers who act in good faith, avoid privacy violations and give us reasonable time to fix an issue before disclosure.