At CMART™ App, the security of your business data and the trust you place in our platform are foundational to everything we do. This page explains how the CMART™ App is built, secured, and operated — and the shared responsibilities that keep your data protected.
The CMART™ App is built on a white-label version of the HighLevel platform — a mature, enterprise-grade Software-as-a-Service infrastructure trusted by tens of thousands of businesses worldwide. Rather than handing non-technical founders and business owners a raw, complex platform and leaving them to configure it, Creative Media Agency customises the CMART™ App specifically for each industry's required usage and outcomes.
This means you get the security, reliability, and scale of an enterprise platform — without the tech-setup overwhelm. Pre-configured workflows, industry-specific templates, and guided onboarding mean your team can adopt the system confidently and securely, with the heavy lifting handled by our team.
The security measures described on this page are drawn from the official HighLevel security and compliance documentation, which is the factual source for the underlying infrastructure. You can review the official platform security documentation at gohighlevel.com/security.
The CMART™ App runs on HighLevel's cloud infrastructure, hosted on Amazon Web Services (AWS) — one of the world's most widely used and audited cloud platforms. AWS data centres maintain multiple independent layers of physical security, including biometric access controls, 24/7 surveillance, environmental monitoring, and redundant power and networking.
Key infrastructure security measures include:
Creative Media Agency does not independently operate the underlying servers, data centres, or network infrastructure. These are managed by HighLevel and AWS under their respective security and compliance programmes.
Your data is protected by encryption both in transit and at rest, consistent with the underlying platform's security standards.
All data transmitted between your browser, the CMART™ App, and integrated services is encrypted using Transport Layer Security (TLS). This includes every page load, form submission, API request, and integration call. TLS ensures that data cannot be intercepted or read while moving across the internet.
Data stored within the platform — including contact records, booking data, message content, and account configurations — is encrypted at rest using industry-standard AES-256 encryption, as provided by the underlying AWS infrastructure.
Account passwords are never stored in plain text. The platform uses salted hash techniques to securely store authentication credentials, meaning that even in the unlikely event of a database compromise, raw passwords would not be exposed.
Access to the CMART™ App is governed by secure authentication and role-based access controls.
Within your CMART™ account, you can assign different permission levels to team members. This means a staff member can be restricted to their own calendar and bookings, while an administrator has full access to CRM data, settings, and billing. You define the access level when inviting each team member, and can adjust it at any time.
The underlying HighLevel platform follows established security engineering practices to protect the software layer your business runs on.
When you use the CMART™ App to store and process your clients' personal information, privacy responsibilities are shared between you, Creative Media Agency, and the underlying platform.
Under South Africa's Protection of Personal Information Act 4 of 2013 (POPIA), you are the Responsible Party for your clients' personal information. You are responsible for:
Creative Media Agency acts as an Operator under POPIA — we process personal information on your behalf solely to deliver the contracted services. We do not use your client data for our own marketing purposes, and we do not sell your data to third parties.
Important: Using the CMART™ App does not automatically make your business POPIA compliant. POPIA compliance requires your own policies, consent processes, and operational practices. The platform provides tools that can support your compliance — such as opt-out links, data export, and consent capture — but compliance is ultimately your responsibility. See our Privacy Policy for full details.
While the platform is built to be secure, the strongest protection comes from combining platform security with good habits on your side. We recommend the following practices for every CMART™ account:
The CMART™ App integrates with a range of third-party services to deliver its features — including payment processors (PayFast, Stripe), calendar systems (Google, Outlook), communication tools (WhatsApp, email), and automation platforms (Zapier, Make). Each integration processes data according to its own terms and security standards.
Some service providers, including the underlying HighLevel platform, are based outside of South Africa. Where personal information is transferred internationally, appropriate safeguards are in place — including contractual protections requiring equivalent data protection standards — consistent with POPIA Section 72.
Security is a shared effort. The CMART™ App's security posture depends on the combined practices of three parties: the underlying platform (HighLevel), Creative Media Agency (the CMART™ builder), and you (the customer).
Responsible for:
Responsible for:
Responsible for:
Because the CMART™ App is customised for each industry, the way security and data handling apply can differ by sector. Below are considerations for the industries we serve. These describe how the platform can be configured — they do not constitute industry-specific legal certifications.
Accounting and financial practices handle sensitive client financial information. The CMART™ App supports role-based access so that client financial records can be restricted to authorised staff only. However, the platform is not a substitute for regulated practice management software where specific financial-sector compliance is legally required. Financial advisors subject to the FAIS Act should ensure their use of the platform aligns with their regulatory obligations.
Health practitioners often handle sensitive patient information. The CMART™ App provides intake forms, secure booking, and access controls that can support a health practice's workflow. The CMART™ App is not HIPAA-certified, and using the platform does not automatically confer HIPAA compliance. Healthcare providers in South Africa should ensure their use of the platform complies with the National Health Act, POPIA's special conditions for personal information, and their professional council's guidelines. If you handle protected health information, consult your professional body and consider additional safeguards.
Real estate professionals manage client contact details, property data, and transaction information. The CMART™ App's CRM and pipeline features allow you to segment and control access to client and property records. Ensure that sensitive financial or identity documents are handled in line with POPIA and the Estate Agency Affairs Act requirements applicable to your practice.
Trades businesses typically handle client contact details, job information, and quotes. The platform's booking and job-management features help you keep client communications organised and accessible only to authorised team members. Standard data protection practices under POPIA apply to the client information you store.
Coaches and consultants often process personal and sometimes sensitive client information through intake forms and session notes. The CMART™ App allows you to capture intake data and manage client relationships securely. Ensure that any sensitive personal information collected through forms is handled in line with your professional obligations and POPIA.
Events and creative businesses manage attendee information, booking details, and sometimes large contact lists. The platform's group booking and communication features help you manage this data with access controls and opt-out mechanisms. When running events, ensure your collection and use of attendee data complies with POPIA, including consent and marketing opt-out requirements.
We believe in being transparent about what the CMART™ App is — and is not — certified for.
The CMART™ App is built on the HighLevel platform, which maintains SOC 2 Type II certification — an independent audit of security, availability, confidentiality, and privacy controls. This certification covers the underlying infrastructure and platform that your CMART™ account runs on. You can review the official platform security documentation at gohighlevel.com/security.
Creative Media Agency does not hold independent security certifications in its own name. The security of the CMART™ App is inherited from the underlying HighLevel platform and its infrastructure providers. We do not claim independent SOC, ISO, or other certifications for the CMART™ App brand.
If you have specific compliance requirements for your industry or jurisdiction, we encourage you to contact us to discuss how the platform can support your needs.
For more detail on how we handle data and your rights, please review our related legal policies:
If you have questions about security, data handling, or compliance that aren't covered here, our South Africa-based team is happy to help. Reach us on WhatsApp or by email using the options below.
Our team is happy to help.
Powered by Creative Media Agency · cmart-app.co.za
We use necessary cookies to make our site work and optional analytics cookies to understand how you use it. By clicking 'Accept All', you consent to our use of cookies. You can manage your preferences or read more in our Privacy Policy.