01Compliance Overview
OnTap maintains a robust compliance program designed to meet the requirements of our customers across diverse industries and jurisdictions. Our compliance posture is built on three pillars: data privacy, information security, and financial/statutory compliance.
We undergo regular third-party audits, maintain industry certifications, and continuously monitor regulatory developments across the jurisdictions in which our customers operate.
02Security Certifications & Standards
SOC 2 Type II
Annual audit of security, availability, and confidentiality controls by an independent CPA firm.
ISO 27001 (In Progress)
Information Security Management System certification — audit scheduled Q3 2025.
Kenya Data Protection Act 2019
Registered with the Office of the Data Protection Commissioner (ODPC).
GDPR Compliant
Full compliance framework for processing EU/EEA personal data.
PCI-DSS Level 3
Payment card industry data security standards for payment processing.
HTTPS / TLS 1.3
All data in transit encrypted with industry-leading transport security.
03Information Security Controls
Our security controls cover the full stack from infrastructure to application to personnel:
- Infrastructure Security: Cloud infrastructure hosted in ISO 27001-certified data centers with physical access controls, redundant power, and network monitoring.
- Data Encryption: AES-256 at rest, TLS 1.3 in transit. Database-level encryption for sensitive fields (PII, payroll data).
- Access Management: Zero-trust architecture, MFA enforced, least-privilege access, privileged access management (PAM).
- Vulnerability Management: Quarterly penetration testing by independent security firms, continuous automated vulnerability scanning.
- Incident Response: Documented incident response plan with defined escalation paths, RTO of 4 hours, RPO of 1 hour.
- Business Continuity: Geographically distributed backups, automated failover, 99.9% uptime SLA.
04Data Residency & Sovereignty
OnTap provides data residency options for enterprise customers with specific sovereignty requirements:
East Africa Region
Primary data residency in Kenya with secondary backups within the region. Default for all African customers.
EU Region
Available for enterprise customers requiring EU data residency for GDPR compliance. Contact sales for configuration.
Custom Residency
Available on Enterprise plan for customers with specific regulatory requirements. Contact enterprise@belfortech.dev.
05Statutory & Regulatory Compliance
OnTap's payroll and HR compliance engine covers statutory obligations across multiple jurisdictions:
- Kenya: PAYE, NSSF Act 2013, NHIF/SHA, NITA, KRA iTax integration, Housing Levy
- Uganda: PAYE, NSSF Uganda, Local Service Tax, employment law compliance
- Tanzania: PAYE, NSSF Tanzania, SDL, employment law compliance
- Nigeria: PAYE, Pension Reform Act, NHIS, ITF levies, NSITF
- Ghana: PAYE, SSNIT, NHIL, Skills Development Levy
- South Africa: PAYE, UIF, SDL, Employment Equity Act reporting
Our compliance team monitors regulatory changes in all supported jurisdictions and pushes updates to the platform before new regulations take effect.
06Audit & Reporting
OnTap provides comprehensive audit capabilities for compliance verification:
- Full immutable audit log of all platform actions with user, timestamp, and IP address
- Payroll audit trails showing every calculation, approval, and disbursement
- Access logs showing who viewed or modified sensitive employee data
- Compliance reports exportable for internal and external audits
- SOC 2 Type II report available to enterprise customers under NDA
- Annual third-party security audit reports available upon request
Questions about this policy?
Our legal and compliance team is happy to help.