POPIA,bydesign

Every sensitive data flow has a documented legal basis and a stated retention position. Every retention window is tenant-configurable. Object-level disposition and crypto-shred each emit a tamper-evident, SHA-256-sealed destruction certificate.

VaultFuzion is a product of Kapardyn Inc., a Delaware corporation. Synchplus Consulting (Pty) Ltd, a company registered in the Republic of South Africa, performs the Services and is the POPIA responsible party. All customer data is processed under South African law.

Processing activities — legal basis and retention

Each entry below sets out the legal basis we rely on for a processing activity and the retention that applies to it. Specific retention parameters are confirmed in your signed agreement and surfaced to you through the Partner Portal.

Microsoft 365 mailbox backup

Legal basis: POPIA §11(1)(d), legitimate interest via your Microsoft data-processing agreement

Retention: Tenant-configurable retention; tamper-evident destruction certificate on object-level disposition

Entra ID identity backup

Legal basis: POPIA §11(1)(d), legitimate interest; contract performance

Retention: Point-in-time identity snapshots on your retention schedule; destruction certificate on object-level disposition

Teams · SharePoint · OneDrive backup

Legal basis: POPIA §11(1)(d), legitimate interest via your Microsoft data-processing agreement

Retention: Follows your existing mailbox-backup retention; no additional storage class

eDiscovery & legal-hold export

Legal basis: POPIA §11(1)(d), legitimate interest; §14 legal-hold obligation

Retention: Held for the duration of the legal hold; released and destructible on your instruction

Retention lifecycle and destruction

Legal basis: POPIA §14, purpose limitation and minimum-retention principle

Retention: Tenant-configurable schedules; tamper-evident destruction certificates

Continuous compliance checks

The platform runs these checks for every tenant on an ongoing basis, surfacing any gap to the responsible partner before it becomes an audit finding.

Retention policy present and current

Encryption at rest and in transit

Tamper-evident audit trail active

Active backup protection in place

Role-based access controls configured

Data residency confirmed (South Africa)

Consent and legal basis recorded

Legal-hold awareness enabled

Proof of deletion available

Purpose limitation respected

Data minimisation applied

Breach notification readiness

Right-to-deletion workflow enabled

LAST REVIEWED · 2026-05-07 · POPIA scoring is operational, not a regulatory verdict.