Security and hosting
Security and hosting
This is what we commit to, as the people who host, back up and run Obel-MS for you. We state it plainly, with no claims about controls we haven’t built yet.
Hosting
- Where your data lives
- We host your Obel-MS workspace on Google Cloud in the region you choose: South Africa (Johannesburg), the European Union (Belgium), the United States (Iowa) or Australia (Sydney). UK workspaces are hosted in the EU region by default. The EU and the UK recognise each other’s data protection as adequate. In-country hosting in London is available on request. Canada, Switzerland, Japan, South Korea, Singapore, India, Brazil, the Middle East and more than 30 other Google Cloud regions are available on request, with a one-off regional setup fee. Your documents, records and backups stay in that region.
- Backups
- Daily backups of your database and documents. We test every restore to confirm it works.
- Encryption
- Your data is encrypted at rest and in transit.
- Availability
- We target 99.5% availability on a best-effort basis.
- Updates
- We apply new features and security patches while the service keeps running, so you never need to plan a downtime window.
Access control
- Roles
- Four roles: Super Admin, Master Admin, Module Admin and Navigator. They show as neutral pills, with no colour coding to decode.
- Permissions
- Access is module-scoped. A Module Admin for Workflow Manager doesn’t automatically get External Document Control, and vice versa.
- Audit trail
- Changes are recorded with who made them and when, so you can answer who approved something and on what date.
AI features
- What it does
- AI reads uploaded supplier documents to suggest metadata such as document type, dates, lot or batch numbers and certificate numbers. It reads digital PDFs directly and scanned Latin-script documents with OCR. It also drafts stage and executive summaries on Workflow Manager records.
- Where it runs
- OCR runs on our own servers in your hosting region. Metadata extraction and summaries use the OpenAI API, a third-party model provider, only for organisations that consent. OpenAI processes the text in the United States by default. For EU and UK workspaces, in-region AI processing is available on request. Under OpenAI’s API terms, data sent through the API is not used to train its models by default.
- No external AI
- A no-external-AI option is available on request for organisations that cannot consent. It uses local extraction on our own servers in your hosting region, so no document text goes to a third-party model. It fills fewer fields correctly, so your team enters more by hand.
- Your control
- An admin can switch AI processing off entirely. Where it runs, a consent gate appears before it processes anything.
- Human in the loop
- Every AI suggestion is Accept, Edit or Dismiss. Nothing files itself without a person approving it.
POPIA
- Our role
- For the documents and records you put in Obel-MS, we act as operator under POPIA. You remain the responsible party for your data.
- Data processing agreement
- A data processing agreement is available on request. Get in touch at chat@obel-ai.com.
On our roadmap
These are not available today. We list them here so you know where things stand.
- Single sign-on
- Sign in with Microsoft Entra ID or Google.Not yet available
- Multi-factor authentication
- A second factor on top of your password.Not yet available
Guides on this topic
- ISO 9001 software in South Africa: what to look forWhat South African SMEs should check when choosing ISO 9001 software, including data residency, POPIA and local support.
- How much does QMS software cost?Typical price ranges for QMS and document control software, what drives the cost, and the hidden costs to ask about.
- Spreadsheets vs QMS software for ISO 9001An honest comparison of running document control in spreadsheets and shared drives against dedicated QMS software.