This page summarises the security measures currently applied to the public iBridge website, how security reports are handled, and the practical limits of a public-facing site. It is intended as an operational overview, not a substitute for internal security standards.
Public forms are being hardened with consent checks, required-field validation, anti-abuse measures, rate-limit safeguards, and backend-ready audit logging. Suspicious or malformed submissions may be blocked, ignored, or logged for review.
The staff portal, intranet, ticketing, LMS, and restricted operational tools are treated as separate access-controlled environments. Public pages do not expose those systems directly and should not be used as a route to bypass authentication.
If you identify a potential issue on the public site, email info@ibridge.co.za with the page URL, time observed, browser or device used, and any screenshots or reproducible steps.
Do not attempt intrusive testing, denial-of-service activity, or unauthorised access. Responsible reporting is expected.
Website security events are reviewed, triaged, and retained according to operational needs. Where a personal-information compromise triggers POPIA obligations, the applicable notification process will be followed.
Some security controls depend on the final hosting platform. Static hosting environments can limit direct control over headers, WAF rules, advanced bot management, and centralised monitoring. Additional hardening is expected at final production deployment.
Security on the public site works together with the Privacy Notice, Cookie Notice, Compliance page, and Accessibility Statement.