Trust Centre
Built by a South African company, subject to POPIA ourselves.
Where your data lives, who can touch it, and how you take it with you if you leave. No certifications we haven't earned, no claims we can't back up.
Where your data lives
Data residency
Production infrastructure runs on AWS eu-west-1 (Ireland), not routed through a US region as an afterthought.
Per-client data isolation
MSP tenants keep each client's devices, tickets, and reports isolated. Clients log into a separate portal and never see another client's data.
No stored card numbers
Card details are tokenised through Paystack at signup. Allocentra never sees or stores your card number. Paystack does, as the payment processor.
Who can access it
Role-based access
Every workspace enforces role-based permissions, so technicians only see and act on what their role allows.
Two-factor and SSO
Every user can turn on authenticator-app two-factor sign-in. Scale and Master plans add SAML single sign-on.
Immutable audit log
Account, billing, and settings changes write to an audit trail your admins can review, not one your team can quietly edit.
Session handling
Sign-in tokens are kept for the browser session only and never in localStorage. Sessions time out after 8 hours of inactivity, with a 5-minute warning before logout.
API keys
Keys are shown once, stored only as a SHA-256 hash, and can be revoked at any time. A key stops working if your plan no longer includes API access.
Your data leaves with you
Switching RMMs is hard enough without a vendor holding your data hostage. You can export it from inside the product, and cancelling doesn't mean losing it overnight.
Export to CSV or Excel
Export any client's devices, tickets, alerts, patches, contacts and audit log to CSV or Excel.
Open API
The REST API is documented publicly and available during your free trial, so you can test an integration or a migration before you buy. Read the API reference →
90-day recovery window
When you cancel, your account data is kept for 90 days.
Then it's deleted
After 90 days, operational data is purged and user records are anonymised. We don't keep it around just in case.
On POPIA, specifically
Allocentra (Pty) Ltd is a South African company and a POPIA responsible party in our own right. The same law our customers answer to applies to us directly, not just to the data you put in our product. If you need information for your own POPIA compliance review (data flows, retention, or a processing agreement), email privacy@allocentra.co.zaand we'll work through it with you directly, not via a support ticket queue.
Have a security questionnaire to get through?
Talk to sales before signup. We'll answer it directly, question by question.