Security Commitment
Herbst Group maintains enforced critical controls governing information security and data protection.
Our security program follows defense-in-depth principles: multiple independent layers of protection ensure that no single failure compromises client data. We conduct continuous monitoring, maintain formal incident response procedures, and integrate lessons learned from every security event into our policies.
Data Protection
Our published privacy policy covers five Herbst Group® entities and was approved by Board Resolution on 11 November 2025.
Your rights under POPIA
We maintain documented procedures for data subject requests including access, correction, deletion, and objection. Contact our Deputy Information Officer attiaan@herbstteam.com.
Cross-border safeguards
Where client data is processed outside South Africa, we maintain Data Processing Agreements with Standard Contractual Clauses covering EU data flows. We have an option for SA-resident data stewardship: client data can be hosted on encrypted infrastructure in Johannesburg, POPIA-bound by design, as we pursue ISO/IEC 27001 and ISO/IEC 42001 certification.
Privacy-first analytics
We use Plausible Analytics, which collects no personal data and sets no cookies.
Client data isolation
Each client's data is isolated in separate database tenants. No client data may be used to enrich, benchmark, or cross-reference another client's engagement.
Email Security
Every email from Herbst Group® is authenticated and encrypted. Both domains achieve PowerDMARC A+ (100%) with full DMARC enforcement:
- DMARCp=rejectUnauthorized senders are rejected
- DKIMSignedCryptographic signing on both domains
- SPFStrictAlignment prevents spoofing
- MTA-STSEnforcePrevents TLS downgrade attacks
- BIMIActiveBrand logo verification on email
- TLS1.3All email encrypted in transit
Verify independently by checking herbstgroup.io or herbstteam.com on any DMARC lookup tool.
Responsible AI Use
Herbst Group® uses Anthropic Claude AI via the commercial API to enhance pharmaceutical consulting services, including research synthesis, report generation, and data interpretation. Licensed third-party data assets that inform this work are governed by controls that ringfence each dataset within the terms of its licence, keeping it isolated from other engagements and never repurposed beyond the scope for which it was licensed.
Controls in place
- All AI-generated content is reviewed by qualified consultants before client delivery
- No clinical decision-making is delegated to AI
- Client data is not used for model training under our commercial API terms with Anthropic
- Claude is accessed only through the Anthropic API, governed by a signed Data Processing Addendum
- Human-in-the-loop oversight on all client deliverables
- Strict data fabrication prevention controls (CEO-enforced)
Legal framework
- Copyright indemnity for AI-generated outputs
- Full ownership of all Claude-generated content retained by Herbst Group®
AI management standard
- Pursuing ISO/IEC 27001 and ISO/IEC 42001 certification; independent audit targeted for 2027.
- AI contribution documented in every report methodology section
Clients are informed when AI assists in analysis. We document the role of AI in our deliverables and welcome questions about our AI governance practices.
Infrastructure & Encryption
Data in transit
TLS 1.3 with HSTS at 1-year max-age. HSTS preload submitted. Comprehensive CSP, X-Frame-Options DENY, Permissions-Policy restricting camera, microphone, and geolocation.
Data at rest
All endpoint devices encrypted with FileVault (AES-256). Backups are encrypted and stored on a daily schedule with formally defined Recovery Time and Recovery Point Objectives.
Data residency
Our data infrastructure is located in South Africa. On a client-elected basis, Herbst Group® houses client data and our intelligence frameworks on our own South African server, under our control and built around POPIA principles, so that data remains resident within South Africa. Any remaining cross-border data flows are documented and covered by Data Processing Agreements.
Security headers (all verified)
Our certification journey
We are a young firm, operating since 2023, and we learn every day. A young firm's first duty is to bring value to the clients who trust it. We formalised our governance as that work, and the data entrusted to us, grew.
ISO/IEC 27001 and ISO/IEC 42001 each require an organisation to establish, implement, maintain and continually improve a management system. A certification audit tests that system as it runs, in two stages. Both apply to any organisation, regardless of size.
What runs today. Since February 2026, we have monitored our information security controls continuously in Vanta, our monitoring platform, not an auditor. A signed set of information security policies is in force and our critical controls are enforced. When a policy changes, we issue a new version for signature. Every AI-assisted deliverable is reviewed by a qualified consultant before it reaches a client. Client data is not used to train models under our commercial API terms. Our Information Officers are registered under POPIA with the Information Regulator; Herbst Group (Pty) Ltd holds registration 2026-001668. Independent, evidence-based assessment is not new to us: Herbst Group holds an EcoVadis Silver sustainability rating, placing us in the top 15% of companies rated worldwide (published March 2026). The rating is valid to March 2027.
Who will verify it. We have appointed A-LIGN as our independent accredited certification body. It will audit our system; it does not build it.
What is next. Herbst Group has committed the time, money and daily discipline it takes to earn independent certification, and we are doing that work in the open. We are pursuing certification to ISO/IEC 27001:2022 and ISO/IEC 42001 in one integrated management system across the four Herbst companies. Stage 1 is targeted for the first quarter of 2027 and Stage 2 for mid-2027. We are not yet certified. A certificate is issued by an accredited body after it has tested the system as it runs. We will not use the word before that day. If a target moves, we publish the change.
Certification standards we pursue
One integrated management system; not yet certified; independent audit targeted for 2027.
Statutory obligations we meet
Information Regulator registration 2026-001668: a registration, never a certificate.
Vendor Risk Management
We conduct formal due diligence on all service providers and maintain a structured vendor assessment framework covering eight areas: data handling, encryption, access controls, incident response, compliance certifications, business continuity, subprocessor management, and contractual protections.
Available on Request
We believe in transparency. Ask and we will share.
Contact us to request any of the above documents.
Environmental Commitment
As a digital-first professional services firm, our environmental footprint is primarily cloud infrastructure and business travel. We measure what matters and set honest targets.
Carbon Offset Programme
Herbst Group® retired 20 tCO2e of verified carbon credits in February 2026 via the Sun Exchange solar project in South Africa, registered with Credible Carbon (RRE_ZLVYE9YA). This offsets 133% of our estimated annual business travel emissions. We follow an Avoid-Reduce-Offset hierarchy calculated under the GHG Protocol (Scope 3, Category 6) and target a 10% year-on-year reduction in travel emissions.
Community Reforestation Partnership
Herbst Group® is a monthly donor to the Greenpop Foundation NPC (NPO 151-411, PBO 930050622), supporting the Forests For Life programme. We fund the planting of 16 indigenous trees per month in community-centred forest restoration sites across South Africa. Each tree is GPS-tracked and verified quarterly. Partnership MOU signed 5 March 2026. First donation made the same day.
2026 Baselines & Targets
Policy Foundation
10 ESG policies signed by leadership and distributed to all staff. Environmental Policy (POL-ESG-001 v1.1) establishes quantified baselines and annual targets. ESG compliance training completed February 2026 with 100% staff attendance.
Environmental Metrics Baseline established February 2026. Carbon offset programme active per POL-ESG-001 v1.1. Reviewed annually per POL-ESG-001. We are pursuing ISO/IEC 27001 and ISO/IEC 42001 certification; independent audit targeted for 2027.
ESG Performance
EcoVadis Silver Medal: Top 15% Globally
March 2026Independent, evidence-based assessment is not new to us: Herbst Group holds an EcoVadis Silver sustainability rating, placing us in thetop 15% of companies rated worldwide (published March 2026). Our scorecard places us in the88th percentile worldwide, and the rating is valid to March 2027.
Independent sustainability rating. Valid through March 2027.
20 tCO2e offsets retired via Credible Carbon (Sun Exchange solar, SA). Exceeds estimated travel emissions. Not carbon neutral.
Controls monitored continuously. ISMS policies signed and enforced. Pursuing ISO/IEC 27001 and ISO/IEC 42001 certification; independent audit targeted for 2027.
Registration 2026-001668.
2026 ESG Commitment
ESG performance is reviewed annually by the CEO. Full sustainability reporting is available in our Sustainability Snapshot 2026 (PDF). Pursuing ISO/IEC 27001 and ISO/IEC 42001 certification; independent audit targeted for 2027.
Security Inquiries
For security inquiries, data protection requests, or to report a vulnerability: