How we handle personal information.
How Pallisade collects, uses, and protects personal information — as responsible party and as operator — in line with POPIA.
Version 2.0 · Effective 9 September 2026 · Governed by POPIA (South Africa)
1Introduction
Pallisade ("Pallisade", "we", "us", "our") is a company that specialises in building bespoke AI and software for financial-industry clients. This Privacy Policy explains how Pallisade collects, uses, stores, and protects personal information. It applies to (a) visitors to pallisadedata.com, (b) prospective and current clients, and (c) end users of software Pallisade builds and operates on a client’s behalf, where Pallisade acts as an operator processing personal information for that client.
Pallisade processes personal information in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA") and, where applicable to a specific engagement, other relevant data-protection laws.
2Roles: responsible party & operator
Two distinct relationships are covered by this Policy, and it is important to keep them separate:
2.1 Pallisade as responsible party
For personal information Pallisade collects directly — through pallisadedata.com, consult bookings, email correspondence, or its own client and vendor records — Pallisade is the responsible party and determines the purpose and means of processing. Paragraphs 3–11 of this Policy describe this processing.
2.2 Pallisade as operator
Where Pallisade builds and runs a system that processes a client’s own data — for example, a client’s investor, deal, or risk data — the client is the responsible party and Pallisade is the operator, processing that data only on the client’s documented instructions. The specific safeguards for a given engagement are set out in a written Data Processing Agreement ("DPA") with that client, consistent with the standards described in this Policy. This public Policy describes Pallisade’s general approach; the DPA for a specific engagement governs that engagement and prevails over this Policy to the extent of any inconsistency.
3Information Officer
Pallisade’s Information Officer is Emil Fabel, who is registered with the South African Information Regulator and is responsible for POPIA compliance across the business. Requests, complaints, or questions regarding personal information should be directed to the contact details set out in paragraph 17 below.
4What we collect
4.1 From website visitors & prospective clients
- Contact details provided when booking a consult or emailing us (name, email address, company, role, phone number);
- The content of any due-diligence questionnaire, brief, or requirements document shared with us;
- Standard web analytics (pages visited, general location inferred from IP address, browser/device type), where cookies or similar technologies are used — see paragraph 11.
4.2 From clients, during an engagement
- Business contact details of the client’s team involved in the engagement;
- Commercial information needed to scope, quote, invoice, and deliver the engagement;
- Where the engagement requires it, the client’s own operational data (which may include personal information about the client’s own customers, investors, or counterparties), and, in some engagements, identity or verification documents (for example, KYC or onboarding documents containing a name, photograph, date of birth, and identity number) — processed strictly as an operator, under paragraph 2.2 above and subject to the specific handling described in paragraph 6.4 below.
4.3 What we do not seek to collect
Pallisade does not seek special personal information (as defined in POPIA — e.g. health, biometric, or religious data) or personal information about children, except where a specific engagement’s data necessarily includes it (for example, KYC or identity documents processed as an operator), in which case it is handled under the heightened safeguards in paragraph 6 and the applicable DPA.
5How we use information & lawful basis
- To respond to enquiries and run consult bookings — necessary to take steps at your request prior to entering an agreement;
- To scope, deliver, invoice, and support an engagement — necessary for performance of a contract with the client;
- To operate systems on a client’s behalf, strictly per that client’s instructions — processed as operator, on the responsible party’s lawful basis;
- To meet legal, tax, and regulatory obligations (for example, invoicing and record-keeping requirements);
- With consent, to send occasional updates about Pallisade’s work — you may withdraw consent at any time.
Pallisade does not sell personal information and does not use client operational data processed as an operator for any purpose beyond delivering and supporting the engagement, save as described in paragraph 6.5 (Derived Data) under the limits set out there.
6How AI processing works — tokenisation, data residency & named providers
Where a Pallisade-built system calls an external AI model as part of a client engagement, personal identifiers are handled with the following design principle: client personal information stays inside South African infrastructure; only de-identified placeholder text is sent to an external AI model.
6.1 Named AI providers
The AI model provider used in a given engagement is disclosed to the client as part of that engagement’s sub-processor register (see paragraph 9) and, at the date of this Policy, is Anthropic’s Claude, accessed via API. Anthropic does not train its models on data submitted through the Claude API, and does not retain such data beyond a limited window, without Pallisade’s express agreement — further detail is in paragraph 6.3.
6.2 Tokenisation
Before any text reaches an external model, a tokenisation layer replaces identifying values — names, ID numbers, and account or contract references — with opaque, sequential placeholders (for example, "CLIENT_1", "ACCT_1"). The mapping between a placeholder and its real value is encrypted and stored only in South African infrastructure; it is never sent externally. The external model receives only the tokenised text and has no way to recover the underlying identity.
6.3 Data residency
Storage and processing of identifiable data stay in-region (South Africa) by default for Pallisade-built systems, including backups. Where a client requires it, Pallisade also supports a fully in-region deployment (including a self-hosted reasoning model) that removes any external AI provider from the data path entirely. Where an external model provider is used, Pallisade engages it under a signed Data Processing Agreement that includes: no use of submitted data to train the provider’s models; purpose limitation to returning the requested output; a defined, limited retention window (or zero data retention, where contractually agreed) before deletion; and industry-standard security controls. Even under a zero-data-retention arrangement, an AI provider may retain specific content flagged by its own automated safety systems for a longer period; Pallisade discloses this residual possibility rather than treating "zero retention" as absolute, and will notify an affected client if it becomes aware that this has occurred in relation to that client’s data.
6.4 Documents and images (including identity documents)
The tokenisation described in paragraph 6.2 applies to text. Where an engagement requires a system to read a document or image — including an identity document, KYC form, or scanned contract — before any identifier within it can be tokenised, Pallisade handles this in one of two ways, disclosed to the client in the applicable DPA: (a) an in-region extraction step reads the document and tokenises any identifiers before any content is sent to an external model, so that the design principle in this paragraph is preserved; or (b) where that is not yet in place for a specific document type, the document is sent to the external model provider directly, routed through a data path that supports zero data retention, and this is disclosed to the client as a named exception rather than assumed to be covered by paragraph 6.2. Pallisade does not process identity or other sensitive documents through an external model without one of these two safeguards in place and disclosed to the affected client.
6.5 AI sub-processors, retention & Derived Data
Because only tokenised, de-identified placeholders are ordinarily sent externally, the residual exposure during any retention window is limited to non-identifying placeholder text, except as described in paragraph 6.4. Pallisade does not use client data, or data derived from it, to train, fine-tune, or benchmark any model or system offered to another client, other than fully de-identified, aggregated learnings that present no reasonable risk of re-identification, consistent with the limits in Pallisade’s Terms of Service.
6.6 Voice & audio
Where a workflow involves voice capture, audio is transcribed in-region using self-hosted transcription so that raw audio — which may contain spoken names — does not leave South Africa; the resulting text is tokenised before any reasoning call, in the same way as text input.
7Automated decision-making
Section 71 of POPIA gives a data subject the right not to be subject to a decision that results in legal or similarly significant effects for them, based solely on automated processing intended to profile them (for example, a solely automated credit, underwriting, or eligibility decision), except in limited circumstances such as where the decision is necessary for a contract, is authorised by law, or the data subject has consented and has an opportunity to make representations.
Pallisade builds systems designed to support, not replace, human decision-making. Consistent with paragraph 8.3 of Pallisade’s Terms of Service, any output bearing on a financial, investment, credit, or insurance decision is designed to be reviewed by a qualified professional before it is relied upon or disseminated — a Pallisade-built system is not intended to produce a decision based solely on automated processing without that review. Where a client nonetheless configures a system to make such a decision without human review, that configuration and its consequences under section 71 of POPIA and any equivalent law are the client’s responsibility as responsible party, and Pallisade will flag this design choice to the client in writing where it becomes aware of it during an engagement.
8Security measures
- Encryption at rest (AES-256) and in transit (TLS 1.2+) across Pallisade-built systems;
- An additional application-level encryption layer over stored personal-information values, separate from disk-level encryption, so a database copy alone does not expose identifying data;
- Role-based access control, multi-factor authentication, and enforced row-level data isolation between clients ("org-scoping");
- Immutable, append-only audit logging of who accessed or changed what, and when;
- Encrypted, regularly tested backups held in-region.
No security measure is infallible, and Pallisade cannot guarantee absolute security, but the measures above are applied as a baseline across engagements and are described in full, engagement-specific detail in the technical and security review pack provided during onboarding and in the applicable DPA.
9Sub-processors & third parties
Pallisade maintains a current sub-processor register for each engagement, provided to that client as part of onboarding and kept up to date; any material addition is disclosed to the client, with a reasonable opportunity to object on data-protection grounds, before it goes live. As a general practice across engagements, Pallisade’s sub-processors typically include:
- A managed database/hosting provider, storing encrypted data in a South African region;
- Anthropic (Claude API), for reasoning, chat, and extraction features, receiving only tokenised, de-identified text (or, where disclosed under paragraph 6.4, specific document content under a zero-data-retention arrangement) under a signed Data Processing Agreement;
- Standard business tools used to run Pallisade itself (for example, email and invoicing), which may process Pallisade’s own contact and billing information, not client operational data.
There is no third-party analytics, advertising, or session-replay service in the data path of any Pallisade-built client system.
10Cross-border transfers
Where tokenised, de-identified text (or, where disclosed under paragraph 6.4, specific document content under a zero-data-retention arrangement) is sent to an AI model provider located outside South Africa, Pallisade’s position rests on two grounds: first, that de-identified placeholder text — which cannot be linked back to a data subject without the encrypted mapping held only in South Africa — falls outside the core restriction in section 72 of POPIA; and second, and in any event, that the receiving provider is bound by a Data Processing Agreement providing an adequate level of protection (including standard contractual clauses, no-training commitments, and security controls), which is itself a recognised section 72 basis for lawful transfer. We note this is a considered legal position rather than a settled one, and clients who require no data of any kind to leave South Africa can request a fully in-region deployment, as noted in paragraph 6.3 above.
12Data-subject rights
Under POPIA, you have the right to:
- Be told what personal information Pallisade holds about you and why;
- Request access to, and a copy of, your personal information;
- Request correction of inaccurate or outdated personal information;
- Request deletion of personal information no longer needed for the purpose it was collected for, or where you withdraw consent;
- Object to processing based on legitimate interest, and withdraw consent for processing based on consent, at any time;
- Object to a decision based solely on automated processing that affects you, as described in paragraph 7;
- Complain to Pallisade’s Information Officer, and, if unresolved, to the Information Regulator of South Africa.
For personal information Pallisade processes as an operator on a client’s behalf, requests should generally be directed to that client (as responsible party) in the first instance; Pallisade will support the client in fulfilling the request in line with the DPA, or can redirect a request it receives directly to the relevant client.
To exercise any of these rights over information Pallisade holds directly, contact us using the details in paragraph 17. We will respond within a reasonable time and in any event within the timeframes required by POPIA.
13Data retention
Pallisade retains personal information only for as long as necessary for the purpose it was collected — for prospective-client enquiries, typically for the duration of the sales conversation plus a limited follow-up period; for client engagement data, for the duration of the engagement plus any period required for legal, tax, or audit purposes; and for client operational data processed as an operator, for the period set out in the applicable DPA, with export and secure deletion available on termination as described in the Terms of Service.
14Breach notification
If Pallisade becomes aware of a security compromise affecting personal information, it will notify the affected responsible party (for operator relationships) or affected individuals and the Information Regulator (for information Pallisade holds directly as responsible party), without undue delay and in any event within the timeframe agreed in the applicable DPA, in line with POPIA’s requirements, and will take reasonable steps to identify and remediate the cause. Where the compromise involves an AI provider retaining flagged content as described in paragraph 6.3, Pallisade will notify the affected client of that fact as part of its notification.
15Children’s information
Pallisade’s website and services are directed at business clients and are not intended for use by children. Pallisade does not knowingly collect personal information from children.
16Changes to this Policy
Pallisade may update this Policy from time to time to reflect changes in its practices or legal requirements. Material changes will be reflected by an updated effective date at pallisadedata.com; clients under an existing DPA will be notified of changes materially affecting how their data is handled.
17Contact & complaints
Questions, requests, or complaints about this Policy or Pallisade’s handling of personal information can be directed to:
- Email: hello@pallisadedata.com
- Information Officer: Emil Fabel — emil@pallisadedata.com (registered with the Information Regulator of South Africa, registration no. 2026-016185)
- Responsible party: Pallisade Data (Pty) Ltd, registration number 2026/328426/07, situated in Cape Town, South Africa
If you are not satisfied with Pallisade's response, you have the right to lodge a complaint with the Information Regulator of South Africa (JZ Cuba House, 27 Stiemens Street, Braamfontein, Johannesburg; complaints.IR@justice.gov.za).