Security & compliance
How Lekgotla protects board material
Board packs are confidential, regulated, and legally significant. These are the controls that back that up. Full documentation is available under NDA.
Tenant isolation
- Each customer is a separate tenant with its own data, roles, and identity boundary — enforced in the data layer, not just the UI.
- The super-admin console runs host-side on a separate origin and never carries a tenant context.
- Sign-in is delegated to the customer's Microsoft Entra ID; MFA is the identity provider's responsibility.
Documents
- Uploads are type-allow-listed, magic-byte sniffed, size-capped, and rejected for path traversal or password protection.
- Every source document is malware-scanned before it can enter a pack.
- Non-PDF formats are converted in an isolated worker; a pack is never compiled from a placeholder page.
The compiled record
- Compilation produces one master PDF; its SHA-256 digest is stored as an immutable version.
- Approval freezes that digest. PAdES signing is refused if the bytes changed after approval.
- Both the unsigned master and the signed artefact are retained for audit.
Access & audit
- Packs are viewed through an authorization-checked endpoint that streams bytes with a per-viewer confidential watermark — no shareable document URLs.
- Every governance action writes an append-only audit entry: pack compile, sign, publish, approval decisions, votes, minutes, resolutions.
- Attendance and activity reports export straight into the record.
Hosting
- Deployed on Microsoft Azure in the South Africa North region.
- Secrets are held in a managed key store; the application never persists private signing keys.
- Infrastructure is defined as code and provisioned per environment.
Need the detailed security pack or a DPA for procurement?
Request documentation