Hosting and data residency
Products run on established cloud infrastructure. TechnoCenter runs as SaaS or in a hosted private cloud (a VPC in AWS), with own-cloud and on-premise options on Premium, so clients can choose where their data lives.
Building technology with responsibility.
How STS protects the products it builds and the data clients trust it with.
STS approaches enterprise delivery through quality practices, defined responsibilities and engagement-specific controls.
Security practices
How the group and its products approach hosting, encryption, access, testing and incidents.
Encryption
TLS on every connection. DigiWise encrypts tokens and sensitive data with AES-256-GCM, and TechnoCenter encrypts data at rest to match each client's deployment.
Access control
Two-factor authentication for every DigiWise wallet holder, SSO and SAML on TechnoCenter Premium, and verified identities for Qudos professionals. Production access is limited to the people who need it.
Testing and audits
Quality assurance is where STS began in 2006, and every release is tested before it ships. DigiWise has an independent security assessment under way.
Incident response
Incidents are triaged, contained and investigated, and affected clients are told without undue delay, in line with POPIA, the GDPR and the UAE PDPL.
Vulnerability disclosure
Found a security issue? Email info@sts.holdings with the subject "Security". We acknowledge reports, investigate them and keep you informed until they are fixed. Please do not test against live client data.
Certifications
ISO 27001
Not currently certified.
SOC 2
Not currently certified.
PCI DSS
Card details are handled by our licensed payment partners and never stored by STS products.
B-BBEE Level 1
Stated for STS Holdings and its subsidiaries, with 135% procurement recognition. Certificate available on request.
Compliance by product
DigiWise Wallet moves money, so it also lists how payments and identity are handled. Each product shows what its own site states about security.
TechnoCenter Live
- Handles customer funds
- No
- Security contact
- info@sts.holdings (subject "Security")
What technocenter.io states
- Personal data is handled in line with POPIA and, where relevant, the GDPR.
- TLS in transit, virus scanning of uploads and daily monitoring; encryption at rest depends on the deployment.
- SSO and SAML on Premium.
- TechnoCenter states that it holds no ISO 27001, SOC 2 or other security certification today.
- The terms are governed by the law of the Republic of South Africa.
DigiWise Wallet Live
- Handles customer funds
- Yes
- Security contact
- info@sts.holdings (subject "Security")
- Payments
- Operates with licensed payment infrastructure partners
- Identity checks
- Users must be 18 or older; identity documents are collected at onboarding, and money laundering is prohibited under the terms
- Complaints
- Through info@digiwisewallet.com
- Card data
- Card details are entered on the payment provider's own page and never reach DigiWise
What digiwisewallet.com states
- Card details are entered on the payment provider's own page and never reach DigiWise.
- Tokens and sensitive data are encrypted with AES-256-GCM.
- Two-factor authentication for every wallet holder, at sign-in and before transfers.
- An independent security assessment is under way; DigiWise lists no certifications or audit reports yet.
- User and transaction data is kept for at least five years, or as the law requires.
- The terms are governed by the law of the Republic of South Africa.
ConstructUI Live
- Handles customer funds
- No
- Security contact
- info@sts.holdings (subject "Security")
Qudos Live
- Handles customer funds
- No
- Security contact
- info@sts.holdings (subject "Security")
What qudos.mobi states
- Professional identity is verified at sign-up.
- Sessions are HTTP-only and short-lived.
- Qudos does not hold or move customer funds.
Legal documents
- Privacy notice
- Terms of use
- Cookie notice
- Data processing agreement (DPA)On request: info@sts.holdings
Security questions
Due-diligence questionnaires, the B-BBEE certificate and the DPA are available on request.