Protect your data. Prove it.
Website security and POPIA compliance services for South African businesses that collect customer information online.
Fixed prices · 2026/27 rates · Plain-language reports
If your website collects personal information, you're responsible for it
Contact forms, bookings, applications, uploads and online payments all collect personal information. Under the Protection of Personal Information Act (POPIA), your business must keep it secure, only keep it as long as needed, and be able to show what safeguards you have in place.
R10m
maximum administrative fine under POPIA
Duty
to notify the Information Regulator and affected people of a breach
Written
agreements required with anyone who processes data for you
The risks small businesses actually face
- Spam and bot attacks flooding forms and inboxes
- Infected uploads reaching staff computers
- Fake emails sent in your name asking customers to pay
- Hacked admin accounts through reused or phished passwords
- Lost data with no backup that actually restores
- Outdated software with known vulnerabilities
- Data kept forever, increasing the impact of any breach
- No plan for who to call when something goes wrong
Creatv Secure closes these gaps in plain language and at small-business prices. We assess your website, fix what matters, document it so you can show clients, auditors or a regulator, and keep it maintained.
Assess. Fix. Prove. Maintain.
- 1
Assess
A Security & POPIA Health Check of your site, data, access and email.
- 2
Fix
Add the protections you need, chosen from fixed-price modules.
- 3
Prove
A written report and POPIA documents you can share with stakeholders.
- 4
Maintain
A monthly Security Care plan keeps it current.
Step 1
Security & POPIA Health Check
Every engagement starts here. You receive a branded, plain-language report with a scorecard, findings rated by risk, and a prioritised action plan.
View pricingHide pricing
Step 1
Security & POPIA Health Check
Every engagement starts here. You receive a branded, plain-language report with a scorecard, findings rated by risk, and a prioritised action plan.
Lite
R2,500
For: Brochure sites with a contact form
- HTTPS and security headers
- Form spam exposure
- Domain and email authentication
- Admin access review
- Short findings report
Standard
Most commonR5,500
For: Sites collecting customer data, bookings or enquiries
- Everything in Lite
- Database and storage access rules
- Backups and recovery
- Third-party services and keys
- POPIA observations
- Full report with sign-off page
Advanced
R9,500
For: Web apps with logins, uploads, payments or sensitive data
- Everything in Standard
- Row-level access control testing
- Upload and form validation testing
- Dependency vulnerability scan
- Service-provider assurance statement
The Health Check fee is credited in full against any Shield package booked within 30 days. Annual re-audits are 40% off the original price.
View pricingHide pricing
Security headers & HTTPS hardening
Forced HTTPS, HSTS, anti-framing and Content-Security-Policy, tested before enforcing
Firewall & bot protection
Edge firewall, privacy-friendly invisible bot check on forms, rate limits on forms and chatbots
Form & upload hardening
Server-side validation, file type and size limits on storage, private file storage
Malware scanning on uploads
Every uploaded file scanned before it's stored or emailed; infected files rejected
Software & dependency update
Framework, plugin or package upgrade with vulnerability re-scan
W · Website protection
Security headers & HTTPS hardening
Forced HTTPS, HSTS, anti-framing and Content-Security-Policy, tested before enforcing
Firewall & bot protection
Edge firewall, privacy-friendly invisible bot check on forms, rate limits on forms and chatbots
Form & upload hardening
Server-side validation, file type and size limits on storage, private file storage
Malware scanning on uploads
Every uploaded file scanned before it's stored or emailed; infected files rejected
Software & dependency update
Framework, plugin or package upgrade with vulnerability re-scan
A · Data & access
Admin access hardening
Enforced 2FA, passkeys for owners, named accounts with least-privilege roles, offboarding checklist
Database access review & fixes
Access rules on every table and storage area, so no visitor can read another person's data
Backup & tested restore
Backup coverage confirmed, a full test restore, written recovery procedure
Data retention & automatic deletion
Retention periods per data type, automatic deletion or anonymisation, deletion log
Audit trail & activity logging
Record of who viewed, changed or exported records, for accountability
E · Email & domain
Email spoofing protection
SPF, DKIM and DMARC, moved to quarantine or reject once monitoring is clean
Domain & DNS lockdown
Registrar lock, DNSSEC where supported, 2FA and recovery details on registrar and DNS accounts
Business mailbox security review
2FA, suspicious forwarding rules, shared mailbox access and sign-in alerts (Microsoft 365 or Google Workspace)
M · Monitoring
Uptime, error & anomaly monitoring
Instant alerts when the site goes down, errors spike, or submissions behave unusually
Login & security alerts
Alerts for repeated failed admin logins, new admin accounts and permission changes
P · POPIA & people
POPIA documentation pack
Website privacy notice, operator agreement, data breach response plan and retention policy, drafted for your legal review
Cookie & consent banner
Consent for analytics and marketing tracking, with a cookie notice
Consent & opt-in capture on forms
Clear consent checkboxes, marketing opt-in and stored consent records
Staff security awareness session
1-hour online session: phishing, passwords, handling customer data, what to do in a breach
Breach response drill
Walk through a realistic scenario with your team using your response plan
Shield packages
Bundled for your type of business
Each package includes the right Health Check, the key modules for that level of risk, and a discount on buying them separately.
View pricingHide pricing
Shield packages
Bundled for your type of business
Each package includes the right Health Check, the key modules for that level of risk, and a discount on buying them separately.
Starter Shield
R7,500
Separately R9,200 · save R1,700
For: Brochure sites, contact forms
- Lite Health Check
- Security headers & HTTPS
- Firewall & bot protection
- Email spoofing protection
- Domain & DNS lockdown
Business Shield
RecommendedR19,500
Separately R25,200 · save R5,700
For: Customer data, bookings, enquiries
- Standard Health Check
Everything in Starter, plus:
Form & upload hardening- Admin access hardening
- Backup & tested restore
- Uptime, error & anomaly monitoring
- Cookie & consent banner
Compliance Shield
R42,500
Separately R53,200 · save R10,700
For: Sensitive data, uploads, payments
- Advanced Health Check
Everything in Business, plus:
Malware scanning on uploads- Retention & automatic deletion
- Login & security alerts
- POPIA documentation pack
- Staff awareness session
- 3 months Business Care
Which one fits?
Shows information and has a contact form
Start withStarter Shield
ThenEssential Care
Takes bookings, enquiries or customer details
Start withBusiness Shield
ThenBusiness Care
Handles ID numbers, health, financial or legal data, uploads or payments
Start withCompliance Shield
ThenCompliance Care
Ongoing
Security Care plans
Security isn't a once-off. New vulnerabilities are found every week, staff change, and backups need testing. A Care plan keeps your protections working.
View pricingHide pricing
Ongoing
Security Care plans
Security isn't a once-off. New vulnerabilities are found every week, staff change, and backups need testing. A Care plan keeps your protections working.
Essential Care
R750 / month
For: Brochure and small business sites
- Monthly software and dependency updates
- Uptime monitoring
- Monthly backup check
- Annual security check
Business Care
RecommendedR1,500 / month
For: Sites collecting customer data
- Everything in Essential
- Error and security alert review
- Quarterly access review
- Quarterly test restore
- Priority support, next business day
- Annual re-audit and updated report
Compliance Care
R3,000 / month
For: Sensitive data, regulated or multi-user systems
- Everything in Business
- 4-hour incident response, business hours
- Quarterly security report
- Email spoofing (DMARC) report monitoring
- Annual staff awareness session
- POPIA documents reviewed yearly
Clients on a Creatv Studio website or marketing plan receive one-third off any Security Care plan.
If something goes wrong
Hacked or defaced site recovery
Contain, clean, restore, close the entry point, and write an incident summary
Incident response support
Help with investigation, evidence and breach notification steps
Ad-hoc security work
Anything outside a module or plan
Clients on a Care plan get emergency response first, at a 20% lower hourly rate.
How we work
What you can expect
- Fixed prices agreed before any work starts
- Plain-language reports you can share with clients, auditors or a board
- Testing before anything goes live, so your site isn't disrupted
- Access limited to named people, protected by 2FA
- A written operator agreement covering how we handle your data
- Full handover of accounts and credentials if we part ways
Terms
- Payment: 50% deposit, balance on completion. Care plans billed monthly in advance.
- Third-party costs (hosting upgrades, scanning services, paid tools) are quoted and approved first, and billed directly to you where possible.
- Prices are in South African rand and valid for 2026/27. Complex systems are quoted after a Health Check.
- Legal: POPIA documents are drafts for review by your legal adviser. We don't provide legal advice.
- No absolute guarantee: these measures significantly reduce risk, but no system is immune to every attack.
Your own POPIA obligations
Every business must register an Information Officer with the Information Regulator, and most need a PAIA manual. These are the business's responsibility, but we can point you in the right direction during your Health Check.
Questions
Protect your data. Prove it.
Book a Security & POPIA Health Check. You'll know exactly where you stand within a week, and the fee comes off any Shield package.