Security

Security is built into how Spotlight is run, not bolted on. Here is a plain summary of the measures that protect your account and data.

Encryption in transit

All traffic to Spotlight is served over HTTPS, and our application connects to its database over an encrypted (TLS) connection. Your data is hosted in South Africa.

Authentication

Sign-in is handled by a specialist authentication provider. We never store your password ourselves. Email verification is required, and multi-factor authentication is available for added protection.

Payments

Card details are entered on the hosted page of our payment processor, PayFast, and are never seen or stored by Spotlight. Every payment notification is signature-verified before we act on it, which protects against tampering and billing fraud.

Access control

Access to production systems is limited to authorised personnel on a least-privilege basis. Secrets and API keys live in protected server configuration, never in our code repository, and we avoid writing personal data into logs.

Backups and resilience

We take regular encrypted backups of the database and store them off the primary server, so your data can be restored if something goes wrong.

Privacy

How we collect and handle personal information, including your rights under POPIA, is set out in our Privacy Policy.

Reporting a vulnerability

If you believe you have found a security issue, please tell us at hello@spotlightseo.co.za before disclosing it publicly. We will acknowledge your report and work with you to resolve it, and we appreciate responsible disclosure.