PAIA Manual

Acronyms & Definitions

Purpose of This Manual

This manual is compiled in terms of Section 51 of PAIA and serves to:

• Inform any person of the records held by IntentGuard and the procedure for requesting access to those records;
• Describe the categories of records available without a formal PAIA request;
• Describe records available under other legislation;
• Provide contact details for the Information Officer who will assist requesters; and
• Describe how IntentGuard processes personal information in terms of POPIA.

The right of access to information is enshrined in Section 32 of the Constitution of the Republic of South Africa, 1996. PAIA gives effect to this right by establishing procedures for requesting access to records held by public and private bodies.

Contact Details of the Information Officer

Guide on How to Use PAIA

The South African Human Rights Commission (SAHRC) has compiled a guide on how to use PAIA. This guide is available:

• On the SAHRC website: www.sahrc.org.za
• From the Information Regulator: www.inforegulator.org.za
• In all 11 official languages and in braille
• By contacting the SAHRC at: SAHRC House, 29 Princess of Wales Terrace, Parktown, Johannesburg, 2193 · Tel: 011 877 3600

The Guide explains: your right of access to records; how to submit a PAIA request; what fees apply; what grounds exist for refusing a request; and how to appeal a refusal.

Records Available Without a Formal PAIA Request

The following categories of records are publicly available and do not require a formal PAIA request:

Records Available Under Other Legislation

IntentGuard, as a private body operating in South Africa, is required to maintain certain records under the following legislation. Access to these records is governed by the relevant legislation and by PAIA.

Subjects & Categories of Records Held

IntentGuard holds records organised under the following subjects. This description is provided to assist requesters in identifying what records may exist.

Processing of Personal Information (POPIA)

8.1 Purpose of Processing

IntentGuard processes personal information for the following purposes:

• Providing the Intent Audit platform and associated services under the Terms of Service;
• Managing user accounts, authentication, and organisation membership;
• Processing subscription payments and billing through our Merchant of Record;
• Sending transactional emails and service notifications;
• Product analytics to improve the platform (with consent on the marketing site);
• Error monitoring and infrastructure security;
• Responding to PAIA requests, data subject requests, and legal obligations; and
• Conducting legitimate business communications with prospective customers (on a legitimate interest basis).

8.2 Categories of Data Subjects

8.3 Transborder Flows of Personal Information

IntentGuard transfers personal information outside the Republic of South Africa to the following third-party sub-processors. All transfers are governed by Data Processing Agreements and, where applicable, Standard Contractual Clauses (SCCs) under GDPR.

8.4 Information Security Measures

IntentGuard implements the following technical and organisational measures to protect personal information:

• All data in transit encrypted via TLS 1.2 or higher across all domains and API endpoints;
• All data at rest encrypted in Supabase (EU West) using AES-256;
• Row Level Security (RLS) enforced at database level — users can only access their own organisation's data;
• GitHub OAuth used for authentication — IntentGuard does not store passwords;
• CSRF protection tokens on all authenticated routes;
• PII scrubbed from error logs before transmission to Sentry via before_send hook;
• Audit sandbox purged immediately after audit completion — source code is never retained;
• 31 secret redaction patterns and 13 injection neutralisation patterns applied to all code before it reaches AI models;
• Audit log append-only: no UPDATE or DELETE permitted on org_audit_log by any role;
• Admin dashboard never linked publicly; protected by INTERNAL_ADMIN_TOKEN; no Cloudflare proxy; and
• detect-secrets pre-commit hook active on all developer machines to prevent accidental secret commits.

8.5 Retention Periods

Procedure for Requesting Access to Records

9.1 How to Submit a Request

Any person wishing to access records held by IntentGuard must submit a written request to the Information Officer. Requests may be submitted:

• By email to: [email protected] (subject line: PAIA Request)
• Using the prescribed PAIA Form 2, available from the Information Regulator at: inforegulator.org.za

The request must include: the requester's full name and contact details; proof of identity; a description of the record requested; the form in which access is required; and if the request is on behalf of another person, proof of authorisation.

9.2 Request Fee

In terms of Section 54 of PAIA and the regulations published in Government Gazette No. 45057 (27 August 2021):

• A request fee of R140.00 is payable before the Information Officer processes the request (unless the requester is a personal requester seeking their own information).
• If the request is granted, an access fee may be charged for search, preparation, and reproduction of the record. Current prescribed fees are published in Annexure B of the PAIA Regulations.
• The Information Officer may waive fees where the request is in the public interest or where the requester demonstrates financial hardship.

9.3 Response Timeline

The Information Officer will decide whether to grant or refuse the request within 30 days of receiving the request (or 30 days after payment of the request fee, whichever is later). This period may be extended by a further 30 days in the circumstances set out in Section 57 of PAIA, with written notice to the requester.

9.4 Grounds for Refusal

IntentGuard may refuse a request on the grounds set out in Chapter 4 of Part 3 of PAIA, including but not limited to:

• Mandatory protection of privacy of third parties (Section 63);
• Mandatory protection of commercial information of third parties (Section 64);
• Mandatory protection of confidential information of third parties (Section 65);
• Mandatory protection of safety of individuals and protection of property (Section 66);
• Mandatory protection of research information (Section 67); and
• Records subject to legal privilege (Section 67).

If a request is refused, the requester will be notified in writing with reasons for the refusal and information about the right to appeal.

9.5 Appeals

If a request is refused or the requester is dissatisfied with the response, the requester may:

• Apply to a court for relief in terms of Section 78 of PAIA; or
• Lodge a complaint with the Information Regulator at: [email protected] or [email protected]

Availability of This Manual

This PAIA Manual is available:

• Free of charge on the IntentGuard website at: intentguard.dev/paia
• By email request to: [email protected]
• For inspection at IntentGuard's principal place of business: 40 Boshoff Street, South Crest, Alberton, Johannesburg, 1449

The manual will be updated when material changes occur to IntentGuard's records, processing activities, or when required by changes in legislation.

Information Regulator Contact Details

Complaints, queries, and requests relating to PAIA and POPIA may be directed to the Information Regulator: