Security & trust
POPIA, handled — data residency, consent, control.
MiMs processes personal information every day: incident reports, statements, investigation files, employee records. The Protection of Personal Information Act sets the rules for how that data is stored, accessed and disposed of, and you are the responsible party. MiMs is built to support your POPIA obligations — hosted in South Africa for data residency, with role-based access, configurable retention and deletion, and an immutable audit trail of who touched what.
Data hosted in South Africa · Role-based access · Configurable retention & deletion · Immutable audit trail · Encryption in transit & at rest · DPA available on request
How MiMs supports your POPIA obligations
The controls that map to the Act
Data residency
Your data is hosted in South Africa, supporting POPIA requirements around where personal information is processed and stored.
Access limitation
Role-based access ensures personal information is available only to those whose role legitimately requires it.
Retention & deletion
Configurable retention rules and deletion support your obligation not to keep personal information longer than necessary.
Consent capture
Capture and record consent where you collect personal information, with the record kept alongside the data.
Accountability trail
An immutable audit trail evidences how personal information was handled — the accountability POPIA expects.
Data processing agreement
A DPA setting out our role as operator is documented and available on request for your legal team.
POPIA compliance is a shared responsibility. You remain the responsible party for the personal information you collect; MiMs gives you the controls, residency and evidence to meet your obligations with confidence.
This page describes how the platform supports POPIA compliance and is not legal advice. Your DPA and processing terms are available for your legal and privacy teams to review.
- Personal information hosted in South Africa
- Role-based access limiting who can view records
- Consent capture recorded with the data
- Configurable retention and secure deletion
- Immutable audit trail for accountability
- Data processing agreement available on request
Honest about what is settled and what is in progress
We publish only verifiable claims. The controls above are documented and available for your review. SSO is shipped and in use. Where any formal certification or attestation is in progress, we state that plainly rather than implying it is already in place.
Ask us anything your privacy officer needs answered — we would rather show you the position than dress it up.
Questions your privacy officer will ask
POPIA FAQ
Is our data kept in South Africa?
Yes. MiMs is hosted in South Africa, supporting POPIA data-residency expectations for personal information.
Can we control how long data is retained?
Yes. Retention and deletion are configurable, so you can align data lifecycles to your own policy and POPIA’s requirement not to keep data longer than necessary.
Do you provide a data processing agreement?
Yes. A DPA setting out our role as operator is documented and available on request for your legal team.
How is access to personal information restricted?
Through role-based access. People see only the personal information their role legitimately requires, and every access sits on an immutable audit trail.
Does MiMs make us POPIA compliant?
MiMs supports your compliance; it does not replace your obligations. You remain the responsible party, and we give you the residency, controls and evidence to meet your duties.
Give your privacy team the answers up front
Book a walkthrough of the POPIA controls, or request the procurement kit for a documented review.
Book a demo