Trust and security
Security at Hesalio.
Hesalio protects your business records and tax data with encryption, access controls and a record of every change.
How we protect data
Protection is built in, not added later.
Your records include sales, payments and tax details, so we designed protection in from the start.
This page sums up our current security practices. If you need a detailed security questionnaire or documentation for procurement, contact our team.
EncryptionYour data is encrypted while it travels (TLS) and while it is stored.
Access by rolePeople see only what their role allows. Admin and staff sign-in is kept separate from customer accounts.
Change historyRecords and account activity show their review status and history, so every change can be traced.
Secure hostingHesalio runs on secured cloud servers, monitored for unauthorised access attempts.
PaymentsCard numbers are entered on the payment provider's secure page and never reach Hesalio. Card and phone-prompt payments activate a plan only after we confirm them with the provider directly, not just because a message says they succeeded, and a repeated notification cannot apply a payment twice.
Refund controlsEvery refund needs a stated reason and a recent authentication code from Hesalio staff, and larger ones need a second person to approve. A repeated request cannot send the same refund twice. Every step is kept in the audit trail, and a refund whose result is unclear is held for a person to check rather than retried.
Only what's neededWe collect and keep only the business data needed to run your records, insights and tax features.
Report an issue
Found a security problem?
We take security reports seriously. Email support@hesalio.africa with "Security" in the subject or reach us through our contact page with details, and we'll follow up.