Heratio Help Center article. Category: Compliance.

Security & Compliance

A Guide for Staff and Administrators

What This Covers

This guide explains how the system protects sensitive materials and helps you meet legal requirements for:

• Privacy - POPIA (South Africa), GDPR (Europe)
• Records Management - NARSSA requirements
• Security Classifications - Controlling who sees what
• Audit Trails - Tracking who did what and when

Security Classifications

The Five Levels

How Access Works

Simple Rule: Your clearance level must be equal to or higher than the record's security level.

Setting Security on Records

When Creating a Record

1. Look for the Security Classification field
2. Select the appropriate level
3. The system remembers this for all future access checks

Changing Security Level

1. Go to the record
2. Click Edit
3. Change the Security Classification
4. Click Save

Note: You can only set security levels up to your own clearance. If you have Confidential clearance, you cannot mark something as Secret.

User Clearance

Checking Your Clearance

1. Click on your username (top right)
2. Select My Profile
3. Your clearance level is shown

Requesting Higher Clearance

Contact your administrator if you need access to records above your current level. They will:

1. Verify your need
2. Get appropriate approval
3. Update your clearance in the system

Privacy Compliance

POPIA (South Africa)

The Protection of Personal Information Act requires us to:

• Only collect information we need
• Keep it secure
• Allow people to see their information
• Delete it when no longer needed

What You Need to Do

Handling Information Requests

If someone asks to see their personal information:

Audit Trail

What Gets Recorded

The system automatically tracks:

Why This Matters

• Accountability - Everyone is responsible for their actions
• Investigation - If something goes wrong, we can find out what happened
• Compliance - Legal requirement for many organisations
• Protection - Protects you by showing you followed procedures

Viewing Audit History

For any record:

1. Go to the record
2. Click History or Audit Trail
3. See all changes with who, what, and when

Embargoes

What is an Embargo?

An embargo prevents access to a record until a specific date. Common reasons:

• Personal information (e.g., 75 years after creation)
• Donor requirements
• Legal restrictions
• Commercial sensitivity

How Embargoes Look

Setting an Embargo

1. Go to the record
2. Click Edit
3. Find Embargo Settings
4. Enter:
   • End date (when it becomes available)
   • Reason
5. Click Save

Requesting Embargo Exemption

If you need access to embargoed material:

1. Submit a written request
2. Explain your research purpose
3. Wait for approval from management
4. If approved, you'll get temporary access

Best Practices

Daily Habits

If Something Goes Wrong

Suspected security breach:

1. Don't panic
2. Stop what you're doing
3. Tell your supervisor immediately
4. Don't try to fix it yourself
5. Document what happened

Lost password:

1. Contact IT support
2. Never share passwords
3. Use the password reset function

Suspicious activity:

1. Note what you saw
2. Report to your supervisor
3. Don't confront anyone directly

Quick Reference

Security Level Colours

Key Contacts

For technical support, contact your system administrator.