Security Commitment
Herbst Group maintains 42 enforced critical controls governing information security, data protection, and AI governance. These controls are locked by CEO authority and cannot be bypassed by any team member, workflow, or automation.
Our security program follows defense-in-depth principles: multiple independent layers of protection ensure that no single failure compromises client data. We conduct continuous monitoring, maintain formal incident response procedures, and integrate lessons learned from every security event into our policies.
Data Protection
Our published privacy policy covers five Herbst Group entities and was approved by Board Resolution on 11 November 2025.
Your rights under POPIA
We maintain documented procedures for data subject requests including access, correction, deletion, and objection. Contact our Information Officer at wimpie@herbstteam.com.
Cross-border safeguards
Where client data is processed outside South Africa, we maintain Data Processing Agreements with Standard Contractual Clauses covering EU data flows.
Privacy-first analytics
We use Plausible Analytics, which collects no personal data and sets no cookies. No consent banner is required because no tracking occurs.
Client data isolation
Each client's data is isolated in separate database tenants. No client data may be used to enrich, benchmark, or cross-reference another client's engagement.
Email Security
Every email from Herbst Group is authenticated and encrypted. Both domains achieve PowerDMARC A+ (100%) with full DMARC enforcement:
Verify independently by checking herbstgroup.io or herbstteam.com on any DMARC lookup tool.
Responsible AI Use
Herbst Group uses Anthropic Claude AI (commercial tier) to enhance our pharmaceutical consulting services, including research synthesis, report generation, and data interpretation.
Controls in place
- ● All AI-generated content is reviewed by qualified consultants before client delivery
- ● No clinical decision-making is delegated to AI
- ● Client data is not shared with Anthropic for model training
- ● Monthly verification ensures continued data opt-out
- ● Human-in-the-loop oversight on all client deliverables
- ● Strict data fabrication prevention controls (CEO-enforced)
Legal framework
- ● Data Processing Agreement with Anthropic (effective 24 February 2025)
- ● Copyright indemnity for AI-generated outputs
- ● Full ownership of all Claude-generated content retained by Herbst Group
Pharmaceutical AI standards
- ● Aligned with NIST AI RMF principles
- ● Implementing GAMP 5 principles for AI/ML in regulated environments
- ● AI contribution documented in every report methodology section
Clients are informed when AI assists in analysis. We document the role of AI in our deliverables and welcome questions about our AI governance practices.
Training & Awareness
Ethics of AI — Mandatory Training Programme
All Herbst Group staff are enrolled in the University of Helsinki Ethics of AI course. This internationally recognised programme covers AI bias, fairness, transparency, accountability, and the societal impact of artificial intelligence.
AI Data Classification — Team Briefing Complete
All Herbst Group staff completed the mandatory AI Data Classification briefing covering the 5-level classification framework, consumer vs commercial API tiers, and the 4-question decision tree for data handling. Attestations signed via DocuSign.
Our AI for Good Commitment
Most industry discourse focuses on AI risks and limitations. That matters. But informed by the University of Helsinki Ethics of AI framework, we also believe in the obligation to use AI for genuine good: better healthcare decisions, stronger compliance, and more accessible intelligence for governed environments.
- ● Benefit to healthcare outcomes. We direct AI capability toward pharmaceutical market intelligence, training quality, and commercial execution that ultimately serves patients.
- ● Transparency by default. Every deliverable discloses where AI contributed. Clients always know what was human-led and what was AI-assisted.
- ● Human oversight, always. AI augments our consultants. It does not replace clinical judgement, strategic thinking, or the accountability that comes with both.
- ● Compliant value for governed environments. We maintain a formal commercial agreement with Anthropic because responsible AI adoption in pharma requires contractual, not just technical, safeguards.
"Very few companies in South Africa take this specific step. It is part of our commercial advantage and also bringing compliant value to governed environments." – Dieter Herbst, CEO
Security awareness is not a one-time exercise. Herbst Group maintains an ongoing training programme covering information security, data protection, and responsible AI use.
Planned Certifications
- ISC2 Certified in Cybersecurity (CC) — CEO + CTO
- NIST Cybersecurity Framework 2.0 self-assessment
- CIS Controls IG1 self-assessment
Awareness Programme
- Quarterly security awareness communications
- Incident-driven policy updates
- Annual compliance review cycle
Infrastructure & Encryption
Data in transit
TLS 1.3 with HSTS at 1-year max-age. HSTS preload submitted. Comprehensive CSP, X-Frame-Options DENY, Permissions-Policy restricting camera, microphone, and geolocation. Mozilla Observatory: A+ (110/100).
Data at rest
All endpoint devices encrypted with FileVault (AES-256). Backups are encrypted and stored on a daily schedule with formally defined Recovery Time and Recovery Point Objectives.
Data residency
Client databases hosted in EU-West (Ireland) with multi-region replication. Cross-border data flows documented and covered by Data Processing Agreements.
Security headers (all verified)
Compliance Journey
Continuous Security Monitoring via Vanta
February 2026Herbst Group has partnered with Vanta, a leading trust management platform trusted by over 9,000 companies globally, to maintain continuous security monitoring as we pursue ISO 27001:2022 certification. Vanta provides automated compliance monitoring, real-time control validation, and transparent evidence collection across our technology stack.
We are actively pursuing ISO 27001:2022 certification with continuous security monitoring through Vanta. Our security programme maintains 9 ISMS policies and 42 enforced critical controls governing information security, data protection, and AI governance, with automated compliance testing across our integrated technology stack.
We maintain a formal incident management process with documented resolution for every security event. Each incident is investigated and resolved with corrective controls that prevent recurrence.
Framework alignment
Vendor Risk Management
We conduct formal due diligence on all service providers and maintain a structured vendor assessment framework covering eight areas: data handling, encryption, access controls, incident response, compliance certifications, business continuity, subprocessor management, and contractual protections.
Available on Request
We believe in transparency. Ask and we will share.
Contact us to request any of the above documents.
Environmental Commitment
As a digital-first professional services firm, our environmental footprint is primarily cloud infrastructure and business travel. We measure what matters and set honest targets.
Carbon Offset Programme
Herbst Group retired 20 tCO2e of verified carbon credits in February 2026 via the Sun Exchange solar project in South Africa, registered with Credible Carbon (RRE_ZLVYE9YA). This offsets 133% of our estimated annual business travel emissions. We follow an Avoid-Reduce-Offset hierarchy aligned with the GHG Protocol (Scope 3, Category 6) and target a 10% year-on-year reduction in travel emissions.
2026 Baselines & Targets
Policy Foundation
10 ESG policies signed by leadership and distributed to all staff. Environmental Policy (POL-ESG-001 v1.1) establishes quantified baselines and annual targets. ESG compliance training completed February 2026 with 100% staff attendance.
Environmental Metrics Baseline established February 2026. Carbon offset programme active per POL-ENV-001 v1.1. Reviewed annually per POL-ESG-001. Herbst Group is pursuing ISO 27001 certification.
Security Inquiries
For security inquiries, data protection requests, or to report a vulnerability: