Short answer
FirstNet delivers its managed Mimecast service from South Africa, and the Mimecast platform supports South African data residency preferences. If you need specific residency wording in your contract, or a mapping to regulatory controls, FirstNet's product and legal teams review it before any commitment.
In detail
What this means for POPIA planning:
- You discuss residency preferences in the onboarding technical workshop, along with retention and archiving.
- Archive retention can be set to 30 days, 1 year, 7 years or 99 years, where archiving is contracted.
- You keep ownership of your mailbox content and make the final calls on retention and governance.
- FirstNet escalates security questionnaires and audit evidence requests for formal review. It does not answer them informally.
Compliance is a shared job. It depends on both the platform and your own settings and governance. FirstNet aligns the service to your privacy and retention needs, but it does not guarantee POPIA compliance.
If residency is a hard requirement, say so at the start of discovery. That way it can be reviewed before you sign a contract.
Source: FirstNet Email Security & Threat Protection service page →
Didn’t answer your question?