Security and data

This page sets out how Adamant Tech handles client data and AI in its engagements. It is written for the security, privacy and procurement reviewers who assess a supplier before work starts. Adamant Tech works to the client’s security policy where it is agreed in the engagement terms, and the written quote records the specifics.

Who leads the work

Adamant Tech (Pty) Ltd is led by its director, Jaco van der Walt. He scopes every engagement, holds every access grant and signs every deliverable. No work is subcontracted to other people unless the client agrees in writing. Sub-processors (hosting, e-mail and model providers) are listed in the proposal.

Continuity. The code and documentation live in the client’s repository, access is granted through the client’s own identity system, and every phase ends with a hand-over pack, so the work does not depend on one person’s laptop.

Client data

• Purpose only. Client data is used only for the engagement it was shared for, and never to train or improve any model or product outside that engagement. Client personal information is processed in the client’s environment or in tools under commercial terms that exclude training, not in Adamant Tech’s own AI tools.
• In the client’s environment where possible. Build and pilot work runs in the client’s own cloud tenant or sandbox. Where that is not possible, it uses masked or sampled data under a signed data agreement.
• Operator terms. Where Adamant Tech processes personal information for a client, it does so as an operator under POPIA, on written terms that set out security measures and breach notification within the time frame agreed in that agreement.
• Cross-border transfers. Most AI model endpoints sit outside South Africa. Where personal information would leave the country, the legal basis is documented and agreed in Discovery, before any data moves.
• At the end. Client data and credentials held by Adamant Tech, including working logs, are returned or deleted at the end of the engagement, as the written quote sets out, except records the law requires Adamant Tech to keep.

Access

• Access is requested per engagement, scoped to what the work needs (for example one mailbox, not every mailbox) and removed at hand-over.
• Read-only access comes first. Write access is added only when a phase that needs it is approved.
• Adamant Tech never asks for credentials by e-mail or chat. Any received that way are treated as compromised and should be rotated. Copies held by Adamant Tech are destroyed at the end of the engagement.

AI models

• Only model providers the client has approved are used.
• Only providers whose terms exclude training on client data are proposed.
• The provider, model and region are named in the proposal, so the client’s reviewers can assess them.

Human oversight

• People approve. Agents prepare work and show their sources. What needs a person’s approval is set per phase in the proposal, and automation is widened only where measured results support it.
• No automated decisions about people. Nothing an agent produces is used to make a decision about a person without a person reviewing it first, unless the client agrees otherwise in writing and POPIA section 71 is met.
• Measured, not promised. Accuracy is measured against known answers and reported per field, before anything scales. Agents are widened only where the numbers support it.
• A record of every step. What an agent read, what it produced and who approved it is logged, in the client’s environment where possible. The logs follow the same return-or-delete rule as the data.

How Adamant Tech runs its own work

Adamant Tech runs its own platform, 12website, the same way. Agent sandboxes hold no production credentials. Each change is tested and reviewed by separate agents and checked automatically. A person approves anything that touches money, security or access, and every production change is planned, reviewed and recorded before it is deployed.

What is not claimed

Adamant Tech holds no ISO 27001 or SOC 2 certification and does not claim one. It follows POPIA-aligned practices; the Information Officer registration with the Information Regulator is in progress. No uptime, response-time or accuracy guarantees are given. Adamant Tech completes reasonable security questionnaires and vendor due-diligence forms before an engagement starts.

Raising a concern

Security or privacy concerns, including a suspected vulnerability, go to contact@adamant.co.za, marked “Security”. The privacy policy is at /privacy.