Built by a CA(SA) for SA compliance.

Komply is built by Matt Owen, CA(SA), founder of Auto Alpha Advisory, in Cape Town. The idea is simple: South African businesses carry four separate regulatory burdens — SARS, POPIA, B-BBEE, and FSCA — and most are checked once a year, if at all. By the time the annual audit comes round, the gaps have been open for months.

Komply turns those four annual scrambles into one subscription with a monthly report. Each module produces a score and a plain-language findings list; a digest on the 1st of each month tells you what needs attention — before it becomes a penalty, a lost tender, or a debarment.

Why a chartered accountant

Compliance is a judgement discipline, not a checkbox. A CA(SA) is trained to read regulation, weigh materiality, and stand behind a number. Komply's scoring is built on that same standard: the compliance ruleset is built against the primary legislation, regulator notices are read every week and shown in your workspace, most with a short machine-written summary, and the ruleset is updated by hand when the rules change. The output is decision-support tooling to inform conversations with your attorney, accountant, or compliance officer — not a substitute for professional advice, and not a substitute for technical security testing either. POPIA §19 also asks for demonstrable, tested safeguards — for that side of the file, Deep Scan provides exploit-confirmed evidence that your web application actually holds up.

How it's built

Tenant data is isolated at the application layer — every query is scoped to your authenticated session — with Row-Level Security on every table as defence in depth. Encryption in transit and at rest. A POPIA-compliant data processing agreement is accepted at onboarding as part of the Terms, and uploaded evidence sits in a private storage bucket, isolated per tenant by path policy. The detail lives in our Data Processing Agreement and Privacy policy.