Security and trust
How we protect your business records
Katlego holds your invoices, your customers' details and what you are owed. This page explains, in plain language, the controls that protect them, what we are and are not as a company, and how to tell us if something looks wrong.
How your information is protected
Encrypted in transit
Everything between your browser and Katlego travels over HTTPS. The service tells browsers to refuse unencrypted connections.
Passwords are never stored
We keep only a one-way scrypt hash of your password, with a unique salt, so the password itself cannot be read back by anyone, including us.
Sensitive fields encrypted again
The secrets behind two-step sign-in and any bank account details you give us are encrypted with AES-256-GCM before they are stored, on top of the database's own encryption at rest.
Each business is walled off in the database
Every record carries the business it belongs to, and PostgreSQL row-level security refuses to return another business's rows. The application connects with a restricted database role that cannot switch this off, and automated tests try to break the isolation on every change.
How your account is protected
Two-step sign-in and passkeys
Add an authenticator app code or a passkey to your sign-in, so a stolen password is not enough on its own.
A second check before money moves
Actions that move money require a two-step verified session, even if you are already signed in.
Limits on sign-in attempts
Repeated sign-in attempts are slowed down and refused, which makes password guessing impractical.
Sessions scripts cannot read
Your session is held in a secure, HTTP-only cookie that page scripts cannot read, and it expires after seven days. Requests that change data are only accepted from Katlego's own pages.
Roles and approval limits
On Pro, each team member signs in as themselves with a role that limits what they can do, and managers can only approve spending up to the limit you set.
How the service is run
Where your data is
The application and its database run on Render and Supabase in Frankfurt, Germany, in the European Union. The European Union's data protection law gives your information protection comparable to POPIA. Our privacy policy lists the service providers that handle your information.
A record nobody can rewrite
Every change in your account is written to an audit log. The database itself refuses to edit or delete audit entries, for the application and for us.
Card details never reach us
Subscription payments are taken on PayFast's own payment page. Katlego never sees or stores your card number.
Secrets kept out of the code
Keys and passwords are held in the hosting providers' protected settings, never in the source code.
What Katlego is
Katlego Finance is a software service for running your invoicing and debtor book. It is not a bank and does not hold or move your customers' payments: they pay you directly. It is not an authorised financial services provider and not a registered credit provider, and it does not give financial advice. The Debtor Health Index and the cash flow forecast describe your own records.
If something looks wrong
If you think someone else has used your account, change your password straight away, turn on two-step sign-in, and email support@katlegofinance.co.za so we can review your account's audit log with you.
If you have found a security weakness, email the same address with "Security" in the subject and enough detail for us to reproduce it. Please do not access anyone else's data, and give us a reasonable time to fix the problem before you tell anyone else. We will not take action against anyone who reports a weakness in good faith this way.
We will never ask for your password or a two-step sign-in code by email, phone or message.
Your information, in detail
What we collect, why, who we share it with and your rights under POPIA are set out in the privacy policy and the data protection page. The service itself is governed by the terms of service.
This page was last reviewed on 21 October 2026.