Data protection in brief

How Tallify protects client data under POPIA: identity and health details removed by code, what Claude reads, local models, third parties and approvals.

The full description is on the Security page. In short:

• No identifiable data leaves the practice. Every identifiable record lives on one server in South Africa, in the practice's own installation hosted by Tallify, or on a server the practice controls.
• Identity is removed by code. Before anything is sent to Claude, names, ID numbers, dates of birth, contact details, addresses and policy numbers are removed on the practice's server, from the structured facts and from free text, for the client, the spouse and anyone else named. A check stops any request that still carries identity. Claude sees "the client, 47, two dependants", never a name.
• Health details are removed too. The client's and the partner's underwriting answers are dropped before any model call, and health words in any other text are replaced with "[health detail removed]". Smoker status is the one exception: the calculations need it.
• Claude writes, code decides. The position, the needs analysis and the client's picture are built by code with no model call. Claude writes the Record of Advice's narrative around the adviser's fixed decision, client replies, fund-movement notices and the weekly cover briefing, from de-identified facts, and reads, scrubbed, the free-text answers of a fact find that the rules could not read (a practice may choose rules only). Names go back in on the practice's server.
• No training. Anthropic's commercial terms exclude training on the data.
• Local models. Models on the practice's server build the search index, run the names check before anything is sent to Claude, read an uploaded Astute CCP report and ID documents, and read the assisted channel. Nothing they read leaves the server. On an installation with a public address, a draft or reply stops if the names check cannot run.
• Other third parties. Email passes through the mail provider, and a hosted practice's web traffic through Cloudflare. The Security page lists what each one receives.
• Approval gate. Nothing is filed without the adviser's and the client's signatures and a named person approving it. No drafted message reaches a client without approval either, unless the practice has listed that kind under Messages sent without approval (none by default).
• Practices apart. Each practice's services run as their own user and can read only that practice's data.
• Audit. Every change, sign-in and communication is logged.

What POPIA allows when a practice uses ChatGPT or any other AI tool with client information: ChatGPT and POPIA.