Docwize is operated by H&M Information Management Services (Pty) Ltd. This page sets out our certification, independent testing and the controls that protect customer data.
Last reviewed 2 October 2026.
Our information security management system (ISMS) is certified to ISO/IEC 27001:2022, the international standard for managing information security risk. It covers the policies, risk assessment, controls and continual improvement behind the Docwize platform.
The certificate and our Statement of Applicability are available on request.
An independent third party tests our internet-facing application and infrastructure at least once a year. The most recent test was a black-box web application assessment following the OWASP Web Security Testing Guide and OSSTMM.
The report is available under NDA.
We assess our Linux servers, Kubernetes clusters and Windows servers against the matching CIS Benchmark at Level 1.
Detailed results are available on request.
We host Docwize in South Africa (Johannesburg) and the European Union. Customers who need EU residency run on a separate platform hosted in the EU. We confirm where each type of data is held for your tenancy as part of onboarding. The providers we use are listed on our sub-processors page.
We process personal information in line with South Africa's Protection of Personal Information Act (POPIA) and, for customers in the EU and UK, the GDPR. Our commitments as a processor are set out in our Data Processing Addendum.
For customers and prospective customers carrying out a vendor security review, under NDA where needed:
If you believe you have found a security vulnerability in Docwize, email security@docwize.com with a description and the steps to reproduce it. We will acknowledge your report and keep you informed while we investigate. When testing, please:
Our contact details are also published in security.txt.
Yes. The information security management system behind Docwize is certified to ISO/IEC 27001:2022 by SANCERT. The certificate is available on request.
At least once a year, by an independent third party. The most recent test, in August 2026, found no high or critical issues and was followed by an independent retest.
In South Africa and the European Union. Customers who need EU residency run on a separate platform hosted in the EU, and we confirm where each type of data is held for your tenancy as part of onboarding.
No. Our AI providers are used under commercial terms that exclude training on submitted data, and Docwize does not train or fine-tune models on customer data.