Confidentiality & Data Protection Statement

1. Purpose & Scope

This Statement explains how CentraSolve (the platform operated at centrasolve.com) handles the confidentiality, integrity and protection of information you and your organisation entrust to it. It applies to all users of the platform, including unregistered visitors, registered users, organisational accounts, and any guest contributors invited to a project, case or engagement.

This Statement is intended to be read by procurement officers, security teams, compliance functions, legal counsel, and the individuals whose personal information is processed. We have written it to be specific and verifiable rather than reassuring and vague. Where there are gaps between what is technically enforced today and what we are working toward, we say so plainly.

This Statement is governed primarily by the Protection of Personal Information Act, 2013 (POPIA) of the Republic of South Africa. Where the personal information of data subjects in the European Union or the United Kingdom is processed, the General Data Protection Regulation (GDPR) and the UK GDPR & Data Protection Act 2018 respectively also apply, and we honour their requirements in parallel.

2. What Data We Hold

An honest inventory of the data categories CentraSolve processes:

Category	Description
Account data	Name, email, password (stored as a salted bcrypt hash, never in plaintext), organisation, role, registration metadata (timestamp, IP).
Organisational data	The organisation you belong to, your role within it, any practitioner registrations (e.g. BRP registration where applicable to Business Rescue work).
Uploaded source documents	Files you upload to projects, cases or engagements (PDFs, Word documents, Excel models, etc.). Stored as binaries on the platform server.
Extracted content	Text extracted from uploaded documents for indexing, search and AI processing. Stored in the database against the relevant document record.
Derived artefacts	Reports, plans, assessments and other outputs you produce on the platform — CBAs, Business Rescue Plans, Restructuring Plans, Strategic Futures reports, and so on.
AI-generated drafts	Narrative drafts produced by CentraSolver© on your explicit request. Stored alongside your project for your review and acceptance.
Audit logs	A record of significant actions (logins, document uploads, artefact generations, deletions) for security and accountability.
Payment records	Subscription tier, invoices, payment status. Card data is not held by CentraSolve; payments are processed by our payment processor.

3. Where Your Data Lives

All CentraSolve production data is hosted on infrastructure provided by Hetzner Online GmbH in Germany, specifically in their Falkenstein data centre region. Hetzner is ISO 27001 certified and is a long-established European hosting provider operating under German and European Union data protection law.

Your data therefore resides within the European Union, in a jurisdiction with mature data protection law (GDPR), and is subject to the strong privacy protections of EU law in addition to those required by POPIA and by this Statement.

Backup copies of production data are held on a separate Hetzner Storage Box, also in Falkenstein, encrypted at rest and accessed only via SSH key authentication. See Section 9 for detail.

4. Protection in Transit

All communication between you and the CentraSolve platform is protected by HTTPS/TLS encryption. The platform uses an ECDSA-signed TLS certificate issued by Let's Encrypt and automatically renewed.

All transfers between the production server and the backup Storage Box are protected by SSH/SFTP encryption, authenticated by an ed25519 SSH key that exists only on the production server and the Storage Box.

No unencrypted protocols are used to handle your data at any point.

5. Protection at Rest

Your data is protected at rest through a layered set of controls:

• Operating-system access controls. The production server permits only SSH key authentication; password-based login is disabled. Only the platform operator's authorised key has access.
• Filesystem permissions. All application files and uploads are owned by a dedicated non-root service user with permissions configured to prevent access by other system users.
• Database access controls. The PostgreSQL database accepts connections only from the application server itself, with credentials held in environment variables that never appear in source code.
• Network firewall. The host firewall permits inbound traffic only on the ports required to serve the platform (HTTPS, SSH from authorised IPs).
• Backup Storage Box. The backup destination is encrypted at rest by Hetzner.

6. Tenant Isolation

CentraSolve is a multi-tenant platform: many organisations share the same underlying infrastructure, with their data logically isolated by an organisation identifier (org_id) attached to every record. Every table that holds organisational data enforces this isolation in every query.

This means that even when two organisations are served by the same database, neither can see the other's data. The application code is the boundary; the architecture has been built so that org-scoped filtering is the default for every read of organisational data, not an opt-in.

7. Access to Your Documents

We treat your uploaded documents as your property and operate on a principle of minimum necessary access. CentraSolve personnel do not access the content of your uploaded documents. The only access to document content is by automated processes essential to the service you have requested:

• Text extraction for indexing — performed automatically on upload so that the platform can search and reference document content within your project.
• AI generation when you explicitly invoke "Ask CentraSolver©" — in which case relevant content is transmitted to our AI sub-processor (see Section 8) under their commercial zero-retention terms.
• Encrypted backup — performed automatically each night to the Storage Box described in Section 9.

Each of these is logged and auditable.

In the rare event that direct operational access to a client's data is required — for example, to investigate a confirmed technical fault you have reported — such access requires a documented justification, is scoped narrowly to what is necessary, is time-limited, and is logged in a record you may request at any time.

8. AI Processing

CentraSolve uses artificial intelligence to assist with drafting narrative artefacts. This capability is branded as CentraSolver© within the platform. Because AI processing involves sending information to a third party, we describe it here in detail.

When AI processing happens

AI processing occurs only when you explicitly invoke it. The most common trigger is clicking the "Ask CentraSolver©" button on a project, case or engagement workspace. AI processing does not happen in the background, on a schedule, or without your action.

What is sent

When you invoke CentraSolver©, the platform constructs a prompt that includes (a) a system instruction describing the task, and (b) the relevant content from your project necessary to complete it — typically a subset of your uploaded document content and structured fields you have captured. The prompt is transmitted over HTTPS to our AI sub-processor.

Who the sub-processor is

The AI sub-processor is Anthropic, PBC, the developer of the Claude family of models. The platform uses Anthropic's commercial Application Programming Interface (API), not the consumer Claude.ai service.

What Anthropic does with the data

Under Anthropic's commercial API terms, customer prompts and completions are not used to train Anthropic's models and are not retained beyond what is necessary to provide the service. Anthropic's published commercial terms specifically establish a zero data retention posture for API customers; CentraSolve is an API customer subject to those terms.

The full text of Anthropic's commercial terms is available at anthropic.com/legal/commercial-terms.

Where Anthropic operates

Anthropic is a United States entity. Data transmitted to Anthropic's API may be processed in the United States. We disclose this transparently so that you can assess it against your jurisdiction's cross-border transfer requirements. For institutional clients with strict EU-residency requirements for all processing — including AI processing — the option to disable AI invocation entirely for your organisation is available; contact us to configure this.

Your control

You are never compelled to use CentraSolver©. All AI invocations are opt-in by user action. Drafts produced by CentraSolver© are presented for your review; you remain the author of record for any artefact that is published or relied upon.

9. Backups

CentraSolve performs automated daily backups of all production data:

• A complete dump of the production database, compressed.
• A complete snapshot of all uploaded documents, compressed.

Backups are transferred over SSH/SFTP to a separate Hetzner Storage Box in the same Falkenstein region, encrypted at rest by Hetzner, and accessed only via a dedicated SSH key.

Retention policy:

• Daily backups: retained for 30 days.
• Monthly snapshots: taken on the first of each month, retained for 12 months.

When you exercise your right to deletion under Section 10, your data is removed from active production systems immediately. Backup copies are overwritten on the standard rotation schedule.

10. Your Rights

Under POPIA and, where applicable, GDPR and UK GDPR, you have the following rights in respect of personal information about you that CentraSolve processes:

• Right of access. You may request a copy of the personal information we hold about you.
• Right of rectification. You may request that inaccurate personal information be corrected.
• Right of erasure. You may request that your personal information be deleted, subject to any overriding legal obligation.
• Right of portability. You may request a machine-readable export of your data so that you can move it elsewhere.
• Right to object. You may object to particular forms of processing, including direct marketing (we do not currently engage in direct marketing).
• Right to know. You may request a log of every occasion on which your personal information has been accessed by any person or process.
• Right to lodge a complaint. You may lodge a complaint with the South African Information Regulator (or, where applicable, your local supervisory authority within the EU or the UK).

To exercise any of these rights, please contact the Information Officer (see Section 17). We will respond within the time periods required by applicable law (within 30 days under POPIA; one month under GDPR / UK GDPR).

For routine deletion of your own projects, cases, engagements or uploaded documents, the platform provides direct self-service controls. Logged-in users can delete their own content from within each workspace.

11. Retention & Deletion

We retain personal information only for as long as is necessary for the purpose for which it was collected, or as required by law.

• Account data. Retained while your account is active. On account deletion, removed within 30 days from active systems; backup retention follows the rotation in Section 9.
• Project, case and engagement data. Retained while the parent record exists. On deletion of a project/case/engagement, all related data is removed from active systems.
• Uploaded documents. Deletable individually by you at any time. Removed from active systems immediately on deletion.
• Audit logs. Retained for a minimum of 24 months for security, accountability and legal-defence purposes, then archived or deleted.
• Payment records. Retained for the period required by South African tax law (currently five years).

12. What We Do Not Do

An explicit list of practices in which CentraSolve does not engage:

• We do not sell your data — to anyone, for any purpose, ever.
• We do not train AI models on your content. Your data is not used to train Anthropic's models or any other AI model.
• We do not use your data for advertising or marketing purposes.
• We do not embed advertising trackers or third-party analytics that profile users.
• We do not share your data with third parties except (a) with the sub-processors listed in Section 14, (b) where you have explicitly directed us to share with a third party you have nominated, or (c) where we are required to do so by law.
• We do not retain your data after you have asked for it to be deleted, beyond the backup rotation schedule already disclosed.

13. Incident Response

In the event of a confirmed personal data breach — meaning an unauthorised disclosure, access, alteration or loss of personal information — we will:

• Notify the affected users without undue delay and in any event within 72 hours of becoming aware of the breach, in line with GDPR Article 33 and POPIA section 22.
• Notify the South African Information Regulator (and, where applicable, other competent supervisory authorities) within the same period.
• Provide a clear description of the nature of the breach, the categories and approximate number of data subjects concerned, the likely consequences, and the measures taken or proposed to address it.
• Cooperate fully with any subsequent investigation.

14. Sub-processors

CentraSolve relies on a small number of carefully chosen sub-processors to deliver the service. Each one is selected for its track record on security and privacy. The current list:

Sub-processor	Role	Location
Hetzner Online GmbH	Production hosting and backup storage	Germany (EU)
Anthropic, PBC	AI processing (only on explicit user invocation; zero-retention API terms)	United States
Let's Encrypt (ISRG)	TLS certificate authority	United States — certificate issuance only, no data processing
Misk.com	SMTP relay for transactional email (account verification, notifications)	South Africa

We will update this Statement and notify registered users in advance of any material change to this list.

15. Compliance Position

CentraSolve operates in accordance with the Protection of Personal Information Act, 2013 (POPIA) of South Africa. Where the personal information of EU or UK data subjects is processed, we honour the requirements of GDPR and UK GDPR in parallel.

16. Changes to this Statement

We will update this Statement from time to time. The version number and effective date at the top of the document reflect the current revision. Material changes will be notified to registered users by email at least 30 days before they take effect, except where a more rapid update is required by law or by a security incident.

Previous versions are archived and may be requested from the Information Officer.

17. Contact & Information Officer

In terms of section 55 of the Protection of Personal Information Act, 2013 (POPIA), the designated Information Officer for CentraSolve is:

Postal correspondence may be requested by emailing the Information Officer; we will provide a confidential service address on request to verified institutional clients and to the South African Information Regulator. We do not publish a physical address publicly in order to respect the privacy of our personnel; this is consistent with the practice of many small data controllers operating from private residences.

For routine queries about your data, your rights, or this Statement, email is the preferred channel and the most reliable way to reach us.