# FirstNet Technology Services: full reference > South African provider of business connectivity, cloud, cybersecurity, voice and sovereign AI, part of the First Technology Group. FirstNet designs, runs and supports all five layers itself, from its own network and data centres in South Africa. FirstCoreAI, the group's AI business, runs a GPU AI Factory in FirstNet's South African data centre so AI workloads and data stay in South Africa. Sales: 0861 989 896, sales@firstnet.co.za. Support (24x7): support@firstnet.co.za. Source: https://www.firstnet.co.za/ (South Africa). Content is published by FirstNet Technology Services. ## Services ### Security Explore Managed Security Services to streamline your cybersecurity while enhancing your IT infrastructure and security posture. URL: https://www.firstnet.co.za/security/ #### Hosted Firewall & Network Security Eliminate physical appliance overhead. FirstNet delivers cloud-hosted firewall & network security with dedicated, multi-tenant Fortinet VDOM segmentation. URL: https://www.firstnet.co.za/security/hosted-firewall-network-security/ #### Email Security & Threat Protection Enhance your Email Security & Threat Protection with advanced filtering and continuity features to combat phishing and malware. URL: https://www.firstnet.co.za/security/email-security-threat-protection/ #### Microsoft 365 Security & Compliance Microsoft 365 security and compliance from FirstNet: identity hardening, data protection and compliance controls tailored to your risk profile. URL: https://www.firstnet.co.za/security/microsoft-365-security-compliance/ #### Managed Cybersecurity Services Managed cybersecurity services in South Africa: FirstNet's SOC monitors your hybrid estate continuously and responds to incidents for you. URL: https://www.firstnet.co.za/security/managed-cybersecurity-services/ #### Secure Access & SSE Protect web use, cloud apps, private apps and sensitive data from one Netskope console, with FirstNet to deploy, support and optionally manage it. URL: https://www.firstnet.co.za/security/secure-access-sse/ #### Web Application & DDoS Protection Cloudflare's global edge, including Johannesburg and Cape Town, protects your public apps and users. FirstNet designs, hardens and tunes it for you. URL: https://www.firstnet.co.za/security/web-application-ddos-protection/ ### Cloud FirstNet provides secure, managed cloud services in South Africa with local data hosting, compliance, and 24/7 support. URL: https://www.firstnet.co.za/cloud/ #### Cloud Migration & Modernization Move legacy infrastructure to a secure, agile cloud. FirstNet delivers phased, low-risk cloud migration and modernization with minimal business downtime. URL: https://www.firstnet.co.za/cloud/cloud-migration-modernization/ #### Private Cloud Hosting & Management Secure your mission-critical workloads with dedicated private cloud hosting in South Africa. Compliant, low-latency, and managed by FirstNet IT experts. URL: https://www.firstnet.co.za/cloud/private-cloud-hosting-management/ #### Data Protection & Ransomware Resilience Safeguard your corporate data locally. FirstNet provides sovereign data protection and ransomware resilience in South Africa with SLA-backed recoveries. URL: https://www.firstnet.co.za/cloud/data-protection-ransomware-resilience/ #### Backup & Disaster Recovery as a Service Protect your business from downtime. FirstNet delivers expert Backup & Disaster Recovery as a Service (DRaaS) in South Africa with automated failover. URL: https://www.firstnet.co.za/cloud/backup-disaster-recovery-as-a-service/ #### Colocation Services A secure, highly available data centre home for your own hardware. We provide the space, power, cooling, physical security and connectivity. You keep full control of your systems. URL: https://www.firstnet.co.za/cloud/colocation/ #### Microsoft Licensing FirstNet is a Microsoft Cloud Solution Provider and Solutions Partner. We bring your Microsoft licences onto one ZAR-billed agreement, keep them right-sized and support them locally. URL: https://www.firstnet.co.za/cloud/microsoft-licensing/ ### Voice Business voice from FirstNet: cloud PBX, Microsoft Teams calling, SIP trunks, compliant call recording and call cost control for South African businesses. URL: https://www.firstnet.co.za/voice/ #### Business Voice Minutes Business voice minutes and SIP trunks from FirstNet, an ICASA-licensed operator in South Africa, with scalable minute bundles instead of rigid contracts. URL: https://www.firstnet.co.za/voice/business-voice-minutes/ #### Cloud PBX & Unified Communications Ditch on-premise PBX hardware. FirstNet runs cloud PBX for South African businesses with clear call quality, CRM integration and 24/7 support. URL: https://www.firstnet.co.za/voice/cloud-pbx-unified-communications/ #### Contact Centre Omnichannel engagement, workforce management, analytics and training in one cloud contact-centre platform, on top of your FirstNet voice and on one contract. URL: https://www.firstnet.co.za/voice/contact-centre/ #### Compliant Call Recording & Analytics Enterprise call recording and analytics hosted in South Africa by FirstNet, with immutable audit trails and QA dashboards for compliance. URL: https://www.firstnet.co.za/voice/compliant-call-recording-analytics/ #### Telephone Management & Cost Control FirstNet's enterprise telephone management system gives clear visibility of call costs, with automated cost allocation by department. URL: https://www.firstnet.co.za/voice/telephone-management-cost-control/ #### Microsoft Teams Calling Make and receive phone calls in Teams on desktop, mobile and web. FirstNet delivers Operator Connect and Direct Routing over its ICASA-licensed network, with local numbers, porting and support. URL: https://www.firstnet.co.za/voice/microsoft-teams-calling/ #### Truecaller for Business Verified Business Caller ID puts your name, logo, verified badge and the reason for the call on your customer's screen before they pick up. FirstNet runs it end to end as a managed service. URL: https://www.firstnet.co.za/voice/truecaller-for-business/ #### Zoom Phone & Contact Centre Zoom does not provide phone numbers in South Africa on its own. FirstNet is a certified Zoom Provider Exchange partner, supplying ICASA-licensed local numbers, porting, implementation and support on one bill. URL: https://www.firstnet.co.za/voice/zoom-phone-contact-centre/ ### Connectivity Eliminate multi-vendor complexity. FirstNet provides secure business connectivity in South Africa with nationwide last-mile access and 24/7 NOC monitoring. URL: https://www.firstnet.co.za/connectivity/ #### Business Internet Connect any branch, anywhere. FirstNet delivers hybrid last-mile connectivity across South Africa using fiber, microwave, LTE, and satellite under one SLA. URL: https://www.firstnet.co.za/connectivity/nationwide-last-mile-connectivity/ #### SD-WAN & Failover A centrally managed, policy-driven overlay that keeps business-critical applications predictable across multiple links, even when one degrades or fails. URL: https://www.firstnet.co.za/connectivity/sd-wan/ #### LEO Satellite Enterprise LEO satellite internet from FirstNet, designed and managed alongside fibre, LTE/5G and SD-WAN for resilient multi-link connectivity. URL: https://www.firstnet.co.za/connectivity/leo-satellite-connectivity/ #### Network & Cloud Reach One provider for nationwide business connectivity in South Africa: FirstNet's standardised coverage with direct routes to global cloud regions. URL: https://www.firstnet.co.za/connectivity/national-footprint-global-reach/ #### Managed Guest Wi-Fi Secure, branded guest access that FirstNet manages end to end across all your sites. Guest traffic stays separate from your business systems, with a clear path to insight and engagement. URL: https://www.firstnet.co.za/connectivity/managed-guest-wifi/ ### Sovereign AI FirstCoreAI is FirstNet's AI business unit. It gives South African organisations GPU compute, open-weight models and engineering talent to run serious AI workloads, while the data stays inside the country and the bill stays in rand. URL: https://www.firstnet.co.za/sovereign-ai/ #### GPU & Inference InfraAI delivers FirstCoreAI's AI Factory as a service: private inference endpoints, dedicated or shared GPU capacity and a curated set of open-weight models, all running in South Africa and reachable through familiar OpenAI-style APIs. URL: https://www.firstnet.co.za/sovereign-ai/ai-factory/ #### Custom AI Engineering Infrastructure alone does not fix a business problem. EngineAI is FirstCoreAI's build team: they take a use case from proof of concept to production, deployed on the AI Factory in FirstNet's data centre or inside your own environment. URL: https://www.firstnet.co.za/sovereign-ai/custom-ai-engineering/ #### Creative & Content AI StudioAI is FirstCoreAI's offering for when content itself is the workload: personalised video, voiceover, copy and design produced quickly and consistently on-brand, connected to the tools and approval steps your team already uses. URL: https://www.firstnet.co.za/sovereign-ai/creative-content-ai/ #### AI Adoption & Enablement FirstCoreAI helps your people use AI well, safely and consistently, with private assistants that run on the Sovereign AI Factory, so your prompts, documents and data stay in South Africa. URL: https://www.firstnet.co.za/sovereign-ai/ai-adoption-enablement/ ### Knowledge Hub URL: https://www.firstnet.co.za/knowledge/ #### All answers URL: https://www.firstnet.co.za/knowledge/ #### Connectivity URL: https://www.firstnet.co.za/knowledge/connectivity/ #### Cloud URL: https://www.firstnet.co.za/knowledge/cloud/ #### Security URL: https://www.firstnet.co.za/knowledge/security/ #### Voice URL: https://www.firstnet.co.za/knowledge/voice/ #### Sovereign AI URL: https://www.firstnet.co.za/knowledge/sovereign-ai/ #### Support URL: https://www.firstnet.co.za/knowledge/support/ ## Knowledge Hub: questions and answers ### Connectivity #### Can FirstNet LEO satellite be used as a backup internet connection? Yes. LEO can be particularly valuable as a backup because the satellite path is independent of many terrestrial fibre routes and network failure points. Integrated with SD-WAN, FirstNet can configure intelligent failover and traffic routing between LEO, fibre, LTE/5G and other connections. Why LEO makes a strong backup: - Independence: it does not rely on terrestrial fibre or mobile towers, reducing the chance of primary and backup failing together. - Hybrid failover: fibre primary with LEO as a critical backup on infrastructure that does not share fibre's failure modes. - SD-WAN path diversity: LEO as a diverse underlay alongside fibre or LTE, with per-site failover. - Bonding: with Peplink, satellite and LTE/5G can be bonded so live sessions continue through a link cut. Compared with LTE/5G as a backup, LEO is independent of mobile towers and more predictable where cellular coverage is rural or unstable, while LTE/5G can be lower cost for light use or urban failover where coverage is strong. Many critical sites use both alongside fibre. FirstNet manages the LEO link like any other part of your network, with proactive monitoring, service management and coordinated support from one accountable partner. URL: https://www.firstnet.co.za/knowledge/connectivity/can-leo-be-used-as-a-backup-connection/. Reviewed 2026-10-10. #### Can FirstNet LEO satellite carry voice calls and Microsoft Teams meetings? Yes. With typical latency of around 50 to 80 ms, FirstNet's Eutelsat OneWeb LEO service supports VoIP, video conferencing and cloud applications at business grade, and pairs with FirstNet's cloud PBX. Latency is the reason. Traditional geostationary satellites orbit much farther from Earth, which adds delay that makes conversations awkward. Low-Earth-orbit satellites are much closer, so round trips are short enough for real-time voice and video. What the service offers: - Typical latency of around 50 to 80 ms - Speeds up to 100 Mbps download and 20 Mbps upload, depending on your service profile - Support for SD-WAN, VoIP, cloud applications and video - Managed installation, monitoring and support included Call quality also depends on the site. Dense tree canopy or structures in the antenna's field of view can affect performance, which FirstNet validates during site readiness, and like all satellite technologies, LEO can be affected by severe weather. For sites where calls must not drop, LEO can be combined with fibre or LTE/5G under SD-WAN, or bonded with Peplink so active SIP and RTP sessions survive a link cut. URL: https://www.firstnet.co.za/knowledge/connectivity/can-leo-carry-voice-calls-and-teams-meetings/. Reviewed 2026-10-10. #### Can FirstNet Peplink bonding keep our business online during load-shedding? Yes, when designed for it. A UPS-backed Peplink router bonding fibre with LTE/5G keeps voice, video, payments and ERP running when power or fibre drops, because the LTE share of traffic simply grows while fibre is down and users typically do not notice the switch. What makes the design work: - Power: the router is UPS-backed, and power and UPS sizing is part of FirstNet's per-site survey. - Links: fibre plus LTE/5G, selected for carrier and technology diversity, with satellite or microwave added where needed. - Data: FirstNet sizes the LTE data pool against expected failover hours. - Visibility: InControl 2 alerts show when failover was active and for how long. - Sessions: sub-second hot failover keeps active calls and RDP sessions running. Load-shedding can affect network equipment beyond your premises too. LTE/5G is not affected by fibre cuts or cable theft, but mobile towers can suffer power outages, which is why bonding two different media, with a UPS at your site, gives better resilience than relying on either alone. For extra independence at critical or remote sites, LEO satellite can be bonded in as a path that does not rely on terrestrial fibre or mobile towers. URL: https://www.firstnet.co.za/knowledge/connectivity/can-peplink-keep-our-business-online-during-load-shedding/. Reviewed 2026-10-10. #### Can FirstNet SD-WAN run on a single internet link? FirstNet does not recommend it. SD-WAN needs at least two links per site to deliver failover and path selection, and best practice is two diverse underlays, often one fibre and one wireless. With only one link, SD-WAN has no alternative path to move traffic onto when the link degrades or fails, so most of its value is lost. Diverse underlays add real resilience because they tend to fail for different reasons. FirstNet's underlay options: - Broadband and DIA: business fibre or dedicated internet as the primary underlay - LTE/5G and microwave: wireless underlays that add path diversity alongside fibre - LEO satellite: an independent path for remote or highly critical sites - Hybrid MPLS: MPLS and internet links side by side for a phased migration FirstNet validates multi-link requirements and link quality at each site during underlay feasibility, before the design goes to joint validation by its Connectivity and Security teams. Because FirstNet is carrier-agnostic, the two links can sit on different carriers as well as different media. FirstNet can supply both links at each site, so the circuits and the overlay sit under one accountable SLA. URL: https://www.firstnet.co.za/knowledge/connectivity/can-sd-wan-run-on-a-single-link/. Reviewed 2026-10-10. #### Can FirstNet connect business sites in remote areas of South Africa? Yes. FirstNet uses multiple access technologies and partners to reach challenging locations, and where last-mile options are limited it designs blended connectivity to meet performance and availability targets. Because FirstNet is carrier- and medium-agnostic, a remote site is not limited to whatever one network covers. The options it works through are: - Licensed microwave: point-to-point or point-to-multipoint radio from a high site to your premises, subject to a line-of-sight survey. - Fixed wireless (FWA / Fixed 5G): where coverage and capacity at your address allow. - LTE/5G: carrier-agnostic mobile broadband wherever there is signal, on the network with the best signal at that site. - LEO satellite: Eutelsat OneWeb low-Earth-orbit service for sites where no terrestrial option fits, with typical latency of around 50 to 80 ms. These can be combined, for example LEO as the primary with LTE/5G alongside it, with SD-WAN steering traffic between them. FirstNet has connected remote mining sites with blended access to meet uptime targets. Every wireless option is validated for your exact address before installation, because trees, buildings, terrain and rooftop access all affect what can be delivered. URL: https://www.firstnet.co.za/knowledge/connectivity/do-we-cover-remote-areas/. Reviewed 2026-10-10. #### Can FirstNet connect business sites outside South Africa? Yes, case by case. Cross-border circuits need partner arrangements and separate licensing, so FirstNet scopes each one before quoting. What to expect: - Scoping: FirstNet confirms the locations, services and performance requirements for each country. - Partners and licensing: the right in-country partner and licensing arrangements are identified. - Quote: pricing and timelines follow once the scope is confirmed. - Delivery and support: sites are brought into FirstNet's unified support model, with NOC monitoring and clear escalation. Some routes beyond South Africa already exist. FirstNet's LEO satellite service on Eutelsat OneWeb is available in South Africa and across Africa. For multinational traffic, FirstNet maintains multi-peer transit at hubs including London, New York, Frankfurt and Singapore. FirstNet has also unified connectivity for a manufacturer across Africa, Europe and APAC with predictable performance. Raise cross-border sites early in a project so they can be scoped alongside the rest of the rollout. Within South Africa, sites are covered by one contract, one SLA and one team. URL: https://www.firstnet.co.za/knowledge/connectivity/can-you-connect-sites-outside-south-africa/. Reviewed 2026-10-10. #### Can FirstNet deliver a large multi-site connectivity rollout in South Africa? Yes. FirstNet has more than 5,000 business sites under management and delivers over 300 new business links every month. Large rollouts are run as one programme, with one contract, one SLA and one team managing every link, rather than as separate projects with each carrier. The delivery model: - Discovery and planning: map sites, dependencies and rollout order. - Feasibility per site: fibre first, then licensed microwave, fixed wireless, LTE/5G and LEO satellite where needed. - Provisioning: carriers and logistics coordinated across regions, using standardised processes and templates. - Handover: each link gets a Service Handover Form and moves to NOC monitoring. - Evolution: add sites and services with minimal overhead. Because FirstNet is carrier-agnostic across every major fibre and mobile network operator, each site gets the best available last mile rather than one network's coverage. Centralised change management handles system-wide changes, and LTE/5G can bring sites live within days where fibre will take longer. FirstNet already provides centralised management and billing across hundreds of branches for a retail customer. URL: https://www.firstnet.co.za/knowledge/connectivity/can-firstnet-deliver-a-large-multi-site-connectivity-rollout/. Reviewed 2026-10-10. #### Can FirstNet direct cloud peering scale as our cloud traffic grows? Yes. Port speeds and capacity can be increased as traffic grows, and FirstNet reviews utilisation and performance KPIs on an ongoing basis so upgrades can be planned rather than made in a hurry. Scalability is designed in from the start. FirstNet's cloud on-ramp process right-sizes capacity during design and keeps it under review: - Assessment: baseline current latency and traffic patterns - Design: right-size ports, redundancy and traffic segregation - Implementation: configure routing, security policies and monitoring - Optimisation: ongoing review of utilisation and performance KPIs, with capacity increased as needed FirstNet runs direct private peering with Microsoft Azure and Microsoft 365, AWS, Google Cloud and major content delivery networks, with engineered headroom for stable performance at peak. One eCommerce customer used direct peering to stabilise checkout performance during seasonal peaks. International growth is covered too: traffic to overseas regions uses multi-peer transit at hubs including London, New York, Frankfurt and Singapore, across seven or more undersea cable systems. If the access links at your sites also need to grow, FirstNet can increase bandwidth or move a site to Dedicated Internet Access for committed, symmetric capacity. URL: https://www.firstnet.co.za/knowledge/connectivity/is-it-scalable/. Reviewed 2026-10-10. #### Can FirstNet integrate LEO satellite with our existing network? Yes. FirstNet links LEO satellite with fibre, LTE/5G, SD-WAN, firewalls and other connectivity services. The result is a managed, resilient network that fits your business needs, and this is where FirstNet adds value beyond the satellite link itself. The satellite provides the connection, and FirstNet manages everything around it. So LEO is not one more standalone service for your IT team to watch. Ways to integrate it: - SD-WAN: LEO as a diverse underlay link, with app-aware routing and smart failover between LEO, fibre and LTE/5G. - Peplink bonding: satellite bonded with LTE/5G or fibre into one connection, so live sessions survive a link cut. - Security: integration with firewalls and FirstNet's security services. - Voice: LEO pairs with FirstNet's cloud PBX for business calls. - Multi-site estates: the same service profile across ATMs, point-of-sale sites, clinics and branches. FirstNet provides proactive monitoring and service management, joined-up support across technologies and providers, and one accountable partner for all your connectivity. Before installation, FirstNet checks site readiness, including sky view, mounting position, power and access. That way, the satellite link joins your network with no surprises on the day. URL: https://www.firstnet.co.za/knowledge/connectivity/can-firstnet-integrate-leo-with-our-existing-network/. Reviewed 2026-10-10. #### Can FirstNet integrate security at the network edge with its connectivity? Yes. FirstNet offers hosted firewalls and SD-WAN options where they fit. That way, security is designed into your network, not added later. Security and connectivity go together. Firewalls, segmentation, secure access and traffic control must match the network design. Managed services keep those controls the same across sites and providers. The options include: - FirstNet hosted firewall and network security services. - FirstNet SD-WAN with built-in security policy enforcement. FirstNet's Security and Connectivity teams check the design together. - Peplink bonded edge devices, paired with FirstNet firewall as a service for security at the edge. - Your own firewall, connected behind a router managed by FirstNet on an Ethernet handoff. - Direct cloud peering, with access to cloud resources based on policy. Guest networks are part of edge security too. FirstNet Managed Guest Wi-Fi keeps guest traffic on its own SSID or VLAN, apart from business systems. For estates with many sites, you get the same security posture at each branch, with one partner to hold to account. FirstNet's Security team can scope the right edge design during discovery. URL: https://www.firstnet.co.za/knowledge/connectivity/can-you-integrate-security-at-the-edge/. Reviewed 2026-10-10. #### Can FirstNet meet strict enterprise SLAs on its ISP and backbone services? Yes. FirstNet tailors SLAs and escalation paths to enterprise needs, backed by a 24/7 NOC and ITIL-aligned service management. Commitments are aligned to the service and to the underlying last mile, so what is promised can be delivered. What sits behind an enterprise SLA from FirstNet: - High availability: diverse paths, multi-homed upstreams and a resilient core design - Monitoring: telemetry, alerts and real-time dashboards, with PRTG-based link monitoring - Service management: ITIL-aligned incident, problem and change management with clear SLAs - Transparency: published performance metrics and regular reviews - Scalability: capacity upgrades without disruptive re-architecture How SLAs vary by service: on broadband and DIA, availability, response and resolution targets follow the underlying carrier's SLA, with service credits passed through once validated. Business fibre carries availability targets up to 99.5% on premium networks. For IP Transit, the SLA covers the FirstNet transit domain, backbone and ports. Strict uptime targets are met through design as much as contract, for example dual-homed DIA or DIA with broadband failover. In one banking deployment, FirstNet achieved 99.99% uptime with proactive capacity upgrades. FirstNet can review your backbone and propose an SLA aligned to your risk profile. URL: https://www.firstnet.co.za/knowledge/connectivity/can-you-meet-strict-slas/. Reviewed 2026-10-10. #### Can FirstNet provide Peplink internet in vehicles and fleets? Yes. Peplink MAX series routers are built for in-vehicle and harsh environments, rated for vibration, temperature and dust, and can bond multiple cellular modems so sessions survive hand-offs between towers. How in-vehicle connectivity works: - Hardware: rugged MAX series cellular routers for vehicles, broadcast, fleet, mining and pop-up use. - Multiple modems: bonding several cellular connections keeps sessions alive while moving between towers; broadcast deployments use four to eight bonded modems to stream live feeds. - Tunnel termination: SpeedFusion Cloud uses Peplink-hosted points of presence, so no fixed central site is needed to terminate the bonded tunnel. - Management: InControl 2 cloud management, run by FirstNet, with day-2 monitoring and ticketing through the FirstNet NOC. Typical uses include logistics fleets, broadcast vans, mining vehicles, mobile clinics and emergency services. Peplink uses standard SIM cards and supports any carrier, so FirstNet's survey can select the mobile network mix that works best for your routes, and FirstNet handles RICA registration for every SIM. Where vehicles operate beyond reliable mobile coverage, satellite can be part of the design: FirstNet's LEO satellite service also supports connectivity on the move. URL: https://www.firstnet.co.za/knowledge/connectivity/can-peplink-provide-internet-in-vehicles/. Reviewed 2026-10-10. #### Can FirstNet provide temporary wireless internet while our fibre is being installed? Yes. LTE/5G can usually be deployed within days so a new site opens on time, while the fibre primary is built over the following weeks or months. Temporary wireless has a minimum six-month term, carries no SLA and is subject to coverage and landlord approval. How the temporary wireless first pattern works: - FirstNet checks coverage and picks the strongest mobile network at your address. - You supply RICA documentation, and FirstNet activates the SIM in a pre-configured, managed router. - The site goes live on LTE/5G, often within a few working days. - In parallel, FirstNet places the fibre order and coordinates landlord, wayleave and municipal approvals. - When the fibre is live, it becomes the primary link. After cutover you can retain the wireless service as a backup, giving the site a diverse failover path that is not affected by fibre cuts. Fibre lead times are typically several weeks to months, and the clock starts once approvals are in place, so running both in parallel avoids delaying an opening. For remote or temporary sites where mobile coverage is weak, LEO satellite is another option that can generally be deployed faster than a new fibre build. URL: https://www.firstnet.co.za/knowledge/connectivity/can-we-get-temporary-wireless-internet-while-our-fibre-is-being-installed/. Reviewed 2026-10-10. #### Can FirstNet put my primary and backup internet links on different carrier networks? Yes. FirstNet is carrier-agnostic, so it can pair links from different carriers and different media, such as fibre with licensed microwave or LTE/5G, so that a single network outage does not become your outage. FirstNet's reach spans every major fibre network operator and mobile network operator in South Africa, so the backup does not have to ride the same network as the primary. Common resilience patterns are: - Primary plus diverse backup: FirstNet's default for revenue-impacting sites, pairing fibre with microwave, fixed wireless or LTE for fast failover. - Dual fibre, different carriers: a secondary fibre on a different carrier network, ideally on diverse physical routes, for high bandwidth and carrier redundancy. - SD-WAN underlay: two diverse FirstNet links per site, typically one fibre and one wireless, with an SD-WAN overlay on top. - Temporary wireless first: LTE deployed in days so a site opens on time while the fibre primary is built. Media diversity matters as much as carrier diversity. Licensed microwave gives air-versus-trench diversity, and LTE/5G is not affected by fibre cuts or cable theft, although it can be affected by tower power outages. FirstNet sets the design by asking what happens if your internet is down for two hours, or a full day. URL: https://www.firstnet.co.za/knowledge/connectivity/can-my-primary-and-backup-links-be-on-different-networks/. Reviewed 2026-10-10. #### Can FirstNet supply the underlying internet links for SD-WAN as well? Yes. FirstNet supplies broadband, Dedicated Internet Access (DIA), LTE/5G, licensed microwave and LEO satellite underlays, so the circuits and the SD-WAN overlay sit under one accountable SLA. SD-WAN is an overlay, so it performs best on well-designed links. FirstNet provides carrier-agnostic underlays, typically two diverse links per site: - Broadband and DIA: business fibre or dedicated internet as the primary underlay - LTE/5G and microwave: wireless underlays that add path diversity alongside fibre - LEO satellite: an independent path for remote or highly critical sites - Hybrid MPLS: MPLS and internet links side by side for a phased migration Supplying both layers closes a common gap: when the overlay and the circuits come from different providers, a performance problem can bounce between them. With FirstNet, one team owns the outcome, from underlay feasibility and link quality at each site through to in-life management. Because FirstNet's reach spans every major fibre and mobile network operator in South Africa, the two links at a site can sit on different carriers and media. Each underlay is validated during feasibility before the design is approved. URL: https://www.firstnet.co.za/knowledge/connectivity/can-you-supply-the-underlying-links-too/. Reviewed 2026-10-10. #### Can guest data from FirstNet Managed Guest Wi-Fi flow into our CRM? Yes. The Capture tier includes standard CRM integrations, and the Engage tier adds loyalty integrations, segmentation and journeys. Non-standard CRM or customer data platform (CDP) integrations are confirmed with FirstNet first. How the tiers build on each other: - Connect: branded captive portal, flexible login (email, mobile, social, or OTP via SMS or WhatsApp), multi-site management and consent-based capture. - Capture (Guest Intelligence): visitor recency, frequency, dwell and repeat visits, multi-site dashboards, scheduled reports, a consented first-party database and standard CRM integrations. - Engage (Guest Engagement): everything in Capture, plus opt-in journeys, audience segmentation, automated campaigns and CRM or loyalty integrations. The data that flows is consented first-party data: guests agree at login, and your organisation remains the data controller. That keeps CRM use aligned with POPIA, provided your consent wording, retention and downstream use are set up correctly, which FirstNet helps with. Tiers can be mixed by venue, for example Capture at flagship sites only. If you plan to connect a specific CRM or loyalty platform, raise it during discovery so the integration path is confirmed before the pilot. URL: https://www.firstnet.co.za/knowledge/connectivity/can-guest-data-flow-into-our-crm/. Reviewed 2026-10-10. #### Can guests on FirstNet Managed Guest Wi-Fi reach our internal business network? No. FirstNet Managed Guest Wi-Fi runs guest access on a dedicated guest SSID or VLAN, so guests only reach the internet and stay separate from your business systems. If you do not have a guest network today, FirstNet helps you plan one. How the separation works: - Dedicated network: guests connect to their own SSID (Wi-Fi network name) or VLAN, kept apart from business systems such as staff devices and point-of-sale. - Your side: you provide access to your Wi-Fi controller settings and a guest SSID or VLAN, and approve the terms and privacy wording. - FirstNet's side: captive portal design, login configuration, site set-up, reporting access, change control and ongoing support. - Content filtering: the optional Purple Shield add-on filters guest content. Separation is the foundation for both security and privacy. Guests log in through a branded captive portal using consent-based login aligned to POPIA and GDPR, and your organisation remains the data controller for the guest dataset. The service runs on the Purple platform, which is ISO 9001 and ISO 27001 certified, with annual third-party audits and ongoing vulnerability and penetration testing. Bandwidth and session limits can also be applied to guest traffic, depending on your Wi-Fi and network policy controls. URL: https://www.firstnet.co.za/knowledge/connectivity/can-guests-reach-our-internal-network/. Reviewed 2026-10-10. #### Can we add a backup link to FirstNet business fibre? Yes, and FirstNet recommends it for any site where downtime costs revenue. Licensed microwave gives air-versus-trench diversity, LTE/5G or fixed wireless gives fast failover, and a secondary fibre on another carrier adds carrier redundancy. Even fibre fails, through last-mile cuts, cable theft or provider outages, so the value of a backup depends on how independent it is from the primary. The options: - Licensed microwave: a radio path that does not share fibre's trench, subject to line of sight. - LTE/5G or fixed wireless: cost-effective failover. LTE/5G is unaffected by fibre cuts and cable theft, though it can be affected by tower power outages. - Second fibre on a different carrier: high bandwidth and carrier redundancy, ideally on a diverse physical route. - LEO satellite: an independent path for remote or highly critical sites that does not rely on terrestrial fibre or mobile towers. - SD-WAN or Peplink bonding: steers or bonds traffic across both links so failover is automatic. Because FirstNet is carrier-agnostic, the backup can sit on a different network from your primary. FirstNet supplies and manages both links, so you keep one contract, one SLA and one point of contact for the site. URL: https://www.firstnet.co.za/knowledge/connectivity/can-we-add-a-backup-link/. Reviewed 2026-10-10. #### Can we brand the FirstNet guest Wi-Fi portal differently per site or brand? Yes. Branding and terms can be managed per venue or brand, usually from a standard template with approved variations. This suits multi-brand groups, franchises and estates with flagship and standard sites. How it works: - Portal design: FirstNet designs the captive portal per brand or venue, using branding assets you supply. - Terms and privacy wording: you approve the wording shown on each portal, which matters for POPIA consent. - Login options: email, mobile, social, or one-time PIN (OTP) via SMS or WhatsApp, configured by FirstNet. - Change control: portal changes run through FirstNet's change control, so updates stay consistent across venues. - Mixed tiers: service tiers can be mixed by venue, for example Capture analytics at flagship sites only. The template approach keeps every site recognisably on-brand while allowing approved local variations, and a new venue can be added without starting from scratch. Multi-site management in the Connect tier gives one place to manage the estate. Optional add-ons include Purple Surveys for real-time guest feedback and Purple Shield for guest content filtering. URL: https://www.firstnet.co.za/knowledge/connectivity/can-we-brand-the-portal-per-site-or-brand/. Reviewed 2026-10-10. #### Can we change the bandwidth on a FirstNet business internet service later? Yes. FirstNet services are designed to scale as requirements change, and bandwidth upgrades and policy changes are part of the ongoing optimisation FirstNet provides once a link is live. How changes work in practice: - On business fibre, an upgrade needs one month's written notice and extends the contract term by at least 12 months. - Optional extras can be added as a site grows, such as additional static public IPs, a dedicated (uncontended) fibre variant or a second fibre link on an alternate carrier. - On IP Transit, common upgrades include more capacity, redundant ports or dual paths, IPv6 enablement and Protected IP Transit. - New locations can be added without rethinking the whole connectivity strategy. The achievable speed still depends on the access technology at the site. Fibre scales furthest. Fixed wireless profiles range from about 5 to 10 Mbps up to 100 Mbps or more, depending on technology and distance, and LTE/5G speeds follow the underlying network plan. If a site has outgrown best-effort broadband, Dedicated Internet Access gives committed, symmetric bandwidth. PRTG bandwidth monitoring on every managed router shows utilisation over time, which helps when planning an upgrade. URL: https://www.firstnet.co.za/knowledge/connectivity/can-bandwidth-be-changed-later/. Reviewed 2026-10-10. #### Can we connect our own firewall to a FirstNet business fibre link? Yes. FirstNet hands off Ethernet from the FirstNet-managed router and your firewall connects behind it. This split gives each party a clear role. FirstNet owns and monitors the access link through its managed router, which is on the PRTG platform for up/down and bandwidth alerting, while you keep control of your security policy and LAN. What to plan for: - VLAN tagging and IP scheme requirements are confirmed during design. - Business fibre includes up to two static public IPs by default: one used on the FirstNet router and one available for your own use, for example on the firewall for VPN or remote access. - Additional public IPs can be added as an option. - Your firewall and LAN configuration remain your responsibility unless separately scoped with FirstNet. - Customer-supplied network equipment must be ICASA type-approved and approved by FirstNet's engineering team. The same approach works for SD-WAN appliances. If you would rather not run the firewall yourself, FirstNet also offers hosted firewall and network security services, and its Security team can work alongside the Connectivity team on the design. URL: https://www.firstnet.co.za/knowledge/connectivity/can-we-connect-our-own-firewall/. Reviewed 2026-10-10. #### Can we get a static IP address on a FirstNet LTE/5G connection? Yes, as an option. FirstNet recommends a static IP for VPN or remote access on LTE/5G, because the default on mobile networks may be shared, dynamic addressing behind carrier-grade NAT (CGNAT). Fixed wireless typically includes one static public IP. Why it matters: with CGNAT, many mobile users share one public address and the address can change, so inbound connections such as a remote-access VPN or a hosted service may not reach your site reliably. A static public IP gives the site a fixed, reachable address. How addressing compares across FirstNet services: - LTE/5G: static IP available as an option - Fixed wireless: typically one static public IP included - Business fibre: up to two static public IPs by default, with more available as an option - Dedicated Internet Access: static public IP addressing and enterprise routing The LTE/5G service runs on a RICA-registered SIM in a pre-configured, FirstNet-managed router, on the mobile network with the best signal at your site. If you plan to use LTE/5G as a backup for a fibre site that runs VPNs, include the static IP in the design so that failover does not break remote access. URL: https://www.firstnet.co.za/knowledge/connectivity/can-we-get-a-static-ip-on-lte-5g/. Reviewed 2026-10-10. #### Can we limit guest bandwidth or session length on FirstNet Managed Guest Wi-Fi? Yes. Limits can be applied to guest bandwidth and session length. The exact method depends on your Wi-Fi and network policy controls, which FirstNet confirms during discovery. Because the service is a hardware-agnostic overlay on your existing Wi-Fi, some controls are enforced by your wireless controller or network policy rather than by the portal itself. That is why discovery comes first: - FirstNet reviews your Wi-Fi controller settings and guest SSID or VLAN set-up. - The limiting methods available on your equipment are confirmed. - Limits are configured alongside the login options and captive portal. - Later changes run through FirstNet's change control. Limits help protect the site's internet link, so guest use does not crowd out point-of-sale, voice or business applications. Guests stay on a dedicated SSID or VLAN, separate from business systems, and the optional Purple Shield add-on adds guest content filtering. If your existing equipment cannot apply the limits you need, upgrades such as new access points or LAN changes can be scoped separately. The pilot at one to four sites, which comes before wider rollout, is a practical point to confirm that limits behave as intended. URL: https://www.firstnet.co.za/knowledge/connectivity/can-we-limit-bandwidth-or-session-length/. Reviewed 2026-10-10. #### Can we trial Peplink bonded connectivity with FirstNet before we commit? Yes. FirstNet can scope a single-site pilot, usually at your worst-performing branch, and uses InControl 2 data at a 30-day review to show how often the bonded edge prevented an outage. How a pilot runs: - Site choice: the branch where connectivity problems hurt most, so the result is meaningful. - Survey: FirstNet maps signal, checks fibre availability and sizes power and UPS. - Links and hardware: links are chosen for carrier and technology diversity, and hardware is sized by throughput, ports, cellular modems and environment. - Install: pre-staged kit is installed and acceptance tested, with InControl 2 managed by FirstNet. - 30-day review: InControl 2 data shows failover events, per-link behaviour and how often the bonded edge kept the site online. The pilot gives you evidence from your own environment rather than a vendor claim. A single site typically takes four to six weeks to deliver. If the pilot proves out, a wider rollout runs in phased waves, and a 50-site rollout typically takes four to six months. A FirstNet specialist can help you choose the pilot site and scope the trial. URL: https://www.firstnet.co.za/knowledge/connectivity/can-we-trial-it-first/. Reviewed 2026-10-10. #### Can we use our own router instead of the FirstNet-managed router on a business link? FirstNet's standard is a FirstNet-managed router, because it lets FirstNet monitor the link and resolve faults quickly. Your own firewall can sit behind it on an Ethernet handoff, and any customer-supplied network equipment must be ICASA type-approved and approved by FirstNet's engineering team. Why the managed router matters: - It is added to FirstNet's PRTG platform for SNMP-based up/down alerting and bandwidth monitoring. - FirstNet sets it up at installation, with sync, throughput and failover testing where applicable. - It remains FirstNet property and is covered by FirstNet's maintenance and replacement policies. - It gives the NOC a consistent view of the link when working faults with the carrier. Keeping your own firewall or SD-WAN device behind the FirstNet router gives you control of security and LAN policy without losing managed monitoring of the access link. VLAN tagging and IP scheme requirements are confirmed during design, and business fibre includes up to two static public IPs by default, one of which is available for your own use. Your LAN and firewall configuration stays your responsibility unless it has been separately scoped with FirstNet. URL: https://www.firstnet.co.za/knowledge/connectivity/can-we-use-our-own-router/. Reviewed 2026-10-10. #### Do FirstNet LTE/5G business internet services need RICA registration? Yes. All SIM-based connectivity in South Africa must comply with the Regulation of Interception of Communications and Provision of Communication-Related Information Act (RICA), so you provide the required RICA documentation when ordering LTE/5G. FirstNet handles the backend compliance and SIM activation. What the process looks like: - You supply RICA documentation with your order. - FirstNet handles registration and activates the SIM. - The SIM is installed in a pre-configured, FirstNet-managed router. - The service can often be live within a few working days. RICA registration is handled for every SIM-based service FirstNet provides, whether LTE/5G is used as a primary link, a backup to fibre, or temporary connectivity while fibre is built. RICA sits alongside FirstNet's wider compliance approach for wireless: services are delivered only through ICASA-licensed network operators on approved spectrum, and all routers and antennas are ICASA type-approved. Have the documentation ready when you order, because it is one of the site-readiness items FirstNet asks for, together with power, access and landlord consent. URL: https://www.firstnet.co.za/knowledge/connectivity/do-lte-5g-business-internet-services-need-rica-registration/. Reviewed 2026-10-10. #### Do fibre cuts or load-shedding affect FirstNet LTE/5G connectivity? LTE/5G is not affected by fibre cuts or cable theft, which makes it a strong backup for fibre. It can, however, be affected by power outages at mobile towers, such as during load-shedding, and by local radio interference. That is why LTE/5G works best as part of a design rather than as a guarantee on its own: - As a fibre backup: a fibre cut does not touch the mobile path, so traffic can fail over while the fibre is repaired. - Network choice: FirstNet is carrier-agnostic and picks the mobile network with the strongest signal at each site, using coverage maps or an on-site signal test. - Power at your site: the router needs power too, so a UPS at the site matters during load-shedding. - Best-effort service: LTE/5G has no fixed uptime SLA, and performance varies with network load. For sites that must stay up through power and fibre outages, FirstNet can design a UPS-backed Peplink router that bonds fibre with LTE/5G, so users rarely notice when power or fibre drops. Where mobile towers are unreliable, LEO satellite offers a path that is independent of both terrestrial fibre and mobile towers. URL: https://www.firstnet.co.za/knowledge/connectivity/do-fibre-cuts-or-load-shedding-affect-lte/. Reviewed 2026-10-10. #### Do we have to replace our MPLS network to use FirstNet SD-WAN? No. Hybrid designs let MPLS and internet links coexist safely, so you can migrate in phases while keeping deterministic support for selected applications. MPLS is a private WAN service that many organisations rely on for predictable inter-site performance, and SD-WAN does not require you to switch it off on day one. A phased approach looks like this: - Hybrid underlay: run MPLS and internet links side by side at each site. - Policy: application-aware steering keeps selected applications on the MPLS path while other traffic uses internet links. - Migration: move sites or applications off MPLS in phases. - Governance: centralised visibility across all sites shows how each path performs. Moving away from MPLS-only networks in phases is one of the scenarios FirstNet SD-WAN is designed for. Whether a hybrid design is needed affects the rollout timeline, so it is settled during underlay feasibility and design. FirstNet supplies the internet underlays (broadband, DIA, LTE/5G, microwave and LEO satellite), and its Connectivity and Security teams validate the hybrid architecture together before anything is deployed. URL: https://www.firstnet.co.za/knowledge/connectivity/do-we-have-to-replace-mpls/. Reviewed 2026-10-10. #### Do we need Peplink InControl 2 for a FirstNet managed Peplink service? For a managed service, yes. Peplink devices can run locally without it, but InControl 2 provides the single-pane operations, alerting, firmware control and per-link visibility that FirstNet's day-2 service relies on. InControl 2 is Peplink's cloud management platform. In a FirstNet deployment it is run by FirstNet on your behalf, and it underpins: - Alerting: InControl 2 alerts feed the FirstNet NOC, so faults are ticketed and managed through one support desk. - Per-link visibility: you can see when failover was active and for how long, for example during load-shedding. - Firmware control: device firmware is managed consistently across the estate. - Single-pane operations: one view across all sites and devices. - Pilot reviews: InControl 2 data is used at the 30-day review of a pilot to show how often the bonded edge prevented an outage. Onboarding to InControl 2 is a standard step in FirstNet's Peplink rollout. It follows the site survey, link selection and hardware sizing, and comes before tunnel termination design and the shipping of pre-staged kit for installation and acceptance testing. URL: https://www.firstnet.co.za/knowledge/connectivity/do-we-need-incontrol-2/. Reviewed 2026-10-10. #### Do we need new Wi-Fi access points for FirstNet Managed Guest Wi-Fi? No. FirstNet Managed Guest Wi-Fi is a hardware-agnostic overlay that works with your existing Wi-Fi. New access points are only included if they are separately scoped. The service sits on top of your current wireless network rather than replacing it. What that means in practice: - You provide: access to your Wi-Fi controller settings, a guest SSID or VLAN, branding assets, and approval of terms and privacy wording. - FirstNet provides: captive portal design per brand or venue, login configuration, site set-up, reporting access, change control and ongoing support. - Separately scoped: new access points, cabling, LAN upgrades, full Wi-Fi redesigns or site surveys. Because it is an overlay, rollout is lighter than a network rebuild. FirstNet starts with discovery, runs a pilot at one to four sites, then rolls out more widely by brand or region readiness. Discovery is also where FirstNet confirms how your controllers handle limits such as bandwidth or session length. If your existing Wi-Fi coverage is poor or you have no guest network yet, FirstNet can help plan one, and any hardware, cabling or survey work is scoped and quoted separately from the guest Wi-Fi service. URL: https://www.firstnet.co.za/knowledge/connectivity/do-we-need-new-access-points/. Reviewed 2026-10-10. #### Do we need our own ASN for FirstNet IP Transit? Yes. FirstNet IP Transit requires a valid public Autonomous System Number (ASN) and a router running BGP. If you do not have these, Dedicated Internet Access is the right managed alternative. An ASN identifies your network in the internet's routing system, and BGP (Border Gateway Protocol) is how your router announces your IP space and exchanges routes with upstream providers. IP Transit is built on that model: it is a Layer 3, BGP-based service that gives your Autonomous System access to the global routing table through FirstNet's upstream and peering ecosystem. What you need to connect: - A public ASN - A router running BGP v4 - IPv4 and/or IPv6 support - In-house capability to manage routing policy and traffic engineering Onboarding starts with ASN validation, where FirstNet confirms your public ASN and routing capability. Your transit port is then provisioned on the FirstNet network, FirstNet establishes the BGP session and route exchange with your router, and the service is tested end to end before handover. You can connect to FirstNet alone or use it as one of several upstreams for resilience and traffic engineering. URL: https://www.firstnet.co.za/knowledge/connectivity/do-we-need-our-own-asn-for-ip-transit/. Reviewed 2026-10-10. #### Do we need to change our cloud setup to use FirstNet direct peering to Microsoft or AWS? FirstNet helps configure networking and security on both ends, on your network and on the cloud side, so you realise the benefits of direct peering safely. Any changes to your cloud environment are identified and planned during design rather than discovered later. FirstNet's architects design cloud on-ramps that align with your security model and growth plans, in four stages: - Assessment: baseline your current latency and traffic patterns. - Design: right-size ports, redundancy and traffic segregation. - Implementation: configure routing, security policies and monitoring. - Optimisation: ongoing review of utilisation and performance KPIs. The design stage covers questions such as how traffic to your Azure or AWS environments is routed and segregated, and which security policies govern access to cloud resources. Microsoft 365 traffic benefits from FirstNet's direct Microsoft peering as part of the network path. Peering also integrates with FirstNet's private connectivity and security services, so the on-ramp forms part of an end-to-end, controlled architecture rather than a standalone link. A FirstNet connectivity assessment quantifies the latency gains you can expect and sets out a peering plan before anything changes. URL: https://www.firstnet.co.za/knowledge/connectivity/do-we-need-changes-in-our-cloud/. Reviewed 2026-10-10. #### Does FirstNet Dedicated Internet Access work with our SD-WAN and firewall? Yes. FirstNet DIA is compatible with enterprise routing platforms, SD-WAN, firewall and cloud connectivity solutions, and supports static public IP addressing. DIA is often chosen precisely because it makes a stable foundation for those platforms. What it brings to the design: - Dedicated 1:1 contention on local and international traffic - Symmetric, committed bandwidth that does not degrade at peak - Predictable latency, jitter and packet-loss characteristics - Static public IP addressing and enterprise routing, delivered as a Layer 3 service into the FirstNet core Common designs include DIA as an SD-WAN hub underlay (a stable, uncontended underlay for SD-WAN and managed security), a resilient internet edge with dual-homed DIA or DIA plus broadband failover behind your firewall, and DIA as the primary internet for a head office or data centre. If you want FirstNet to manage the overlay as well, FirstNet SD-WAN runs across DIA, broadband, LTE/5G, microwave and LEO satellite underlays, with FirstNet's Connectivity and Security teams validating the architecture together before rollout. Integration details such as IP addressing and routing are confirmed during qualification and feasibility. URL: https://www.firstnet.co.za/knowledge/connectivity/does-dia-work-with-our-sd-wan-and-firewall/. Reviewed 2026-10-10. #### Does FirstNet IP Transit support IPv6? Yes. FirstNet IP Transit supports IPv4 and IPv6, and IPv6 enablement can be added as your network evolves. IPv6 is the newer internet addressing standard, with a far larger address space than IPv4, and many operators run both side by side while their customers and services migrate. FirstNet IP Transit accommodates that approach: - Requirements: a public ASN, a router running BGP v4, and IPv4 and/or IPv6 support - BGP set-up: FirstNet establishes the BGP session and route exchange with your router during onboarding - Upgrade path: IPv6 enablement is one of the common upgrades, alongside more capacity, redundant ports or dual paths, and Protected IP Transit - Responsibility: ASN and IP space compliance, routing policy and traffic engineering remain yours The transit itself is a Layer 3, BGP-based service that gives your Autonomous System access to the global routing table through FirstNet's upstream and peering ecosystem, which includes direct peering at NAPAfrica, JINX, CINX and DINX. If you are planning an IPv6 rollout, raise it during onboarding or at a capacity review so it can be scoped with the rest of your transit design. URL: https://www.firstnet.co.za/knowledge/connectivity/do-you-support-ipv6/. Reviewed 2026-10-10. #### Does FirstNet direct cloud peering improve Microsoft Teams calls and video meetings? It helps. Direct peering and uncongested paths give more consistent latency, so cloud and voice workloads behave closer to a local network than they would over the public internet. Call quality still depends on your site's last-mile link. Real-time communications such as voice and video conferencing are particularly sensitive to latency, jitter and packet loss. FirstNet addresses the parts of the path it controls: - Direct private peering with Microsoft Azure and Microsoft 365, AWS, Google Cloud and major CDNs - Engineered headroom for stable performance at peak - Quality of Service and traffic shaping, so business-critical applications get priority during congestion - 24x7 monitoring of latency, packet loss and jitter, not just line availability The last mile is the other half. A congested or failing access link will still affect calls, so critical sites benefit from a diverse backup, and SD-WAN can steer real-time traffic onto the best-performing link. Where a link failure would otherwise drop live calls, Peplink bonding keeps active sessions, including SIP and RTP voice traffic, running through a link cut. FirstNet can baseline current latency at your sites as part of a connectivity assessment. URL: https://www.firstnet.co.za/knowledge/connectivity/does-direct-cloud-peering-improve-teams-calls-and-video-meetings/. Reviewed 2026-10-10. #### Does FirstNet direct peering help Microsoft 365 users? Yes. Microsoft 365 is part of FirstNet's direct Microsoft peering, so productivity traffic takes a direct path to Microsoft rather than crossing congested public routes. Microsoft 365 is used all day by most staff, and real-time tools such as calls and video meetings are particularly sensitive to latency, jitter and packet loss. Direct peering with engineered headroom gives more consistent performance at peak, so cloud and voice workloads behave closer to a local network. How FirstNet delivers it: - Direct private peering with Microsoft, including Azure and Microsoft 365 - Dedicated routes that avoid internet congestion - Integration with FirstNet's private connectivity and security services - Ongoing review of utilisation and performance KPIs Peering improves the path from FirstNet's network to Microsoft, but the experience at each site still depends on the last mile. FirstNet designs business fibre around what each site runs, including Microsoft 365 and SaaS platforms, and Dedicated Internet Access gives head offices committed, symmetric bandwidth. A diverse backup link keeps Microsoft 365 reachable if the primary fails. URL: https://www.firstnet.co.za/knowledge/connectivity/does-direct-peering-help-microsoft-365-users/. Reviewed 2026-10-10. #### Does FirstNet handle business connectivity customer data in line with POPIA? Yes. FirstNet handles customer data in line with POPIA, the Protection of Personal Information Act. It also follows its own information security management system, which is certified to ISO 27001. That system covers security governance, risk management, change control, monitoring and incident response, all under audit. ISO 27001 is the global standard for running information security. FirstNet also holds ISO 9001 for quality management. Being certified means these controls are written down and checked by independent auditors, not simply claimed. If you need specific regulatory or POPIA wording in a contract, FirstNet's product and legal teams review it. They do not agree to it on the spot. That keeps the commitment in line with what the service actually delivers. For services that collect personal information directly, the duty is shared. With FirstNet Managed Guest Wi-Fi, for example: - The platform provides consent-based login and data capture aligned to POPIA and GDPR. - Your business stays the data controller for its guest data. - Your choices on login method, consent wording, retention and data use decide the compliance outcome. FirstNet helps you set this up correctly. URL: https://www.firstnet.co.za/knowledge/connectivity/does-firstnet-handle-connectivity-customer-data-in-line-with-popia/. Reviewed 2026-10-10. #### Does FirstNet supply the internet links that Peplink bonds? Yes. Peplink bonds the circuits but does not provide them: FirstNet supplies the fibre, Dedicated Internet Access, LTE/5G and LEO satellite links under its Connectivity services, and Peplink bonds them into one resilient connection. You can also bond links you already have. Either way, circuits, bonding hardware and day-to-day management sit with one accountable provider. How FirstNet puts the links together: - Per-site survey: signal mapping, fibre availability, power and UPS sizing. - Link selection: carrier and technology diversity at each site, based on mobile coverage, fibre availability and satellite line of sight. - Hardware sizing: by throughput, ports, cellular modems and environment. - Management: InControl 2 run by FirstNet, with monitoring and ticketing through the FirstNet NOC. Because FirstNet is carrier-agnostic across every major fibre and mobile network operator in South Africa, the links bonded at a site can come from different networks, which is what gives bonding its resilience. Licensed microwave is also available from FirstNet as a link type. When FirstNet supplies both the links and the bonding, a fault is handled by one team, whether the cause is a fibre cut, a mobile network issue or the router itself. URL: https://www.firstnet.co.za/knowledge/connectivity/does-firstnet-supply-the-internet-links-that-peplink-bonds/. Reviewed 2026-10-10. #### Does FirstNet support multi-country connectivity deployments beyond South Africa? Yes. FirstNet works with partners around the world to offer the same services beyond South Africa. Cross-border circuits need partner arrangements and separate licences, so FirstNet scopes each case before it quotes. How FirstNet runs a rollout across several regions: - Discovery and planning: map your sites, what depends on what, and the rollout order. - Provisioning: line up carriers and logistics in each region. - Support: one helpdesk, NOC monitoring and a clear path to escalate. - Growth: add sites and services with little extra overhead. For one manufacturer, FirstNet joined up the network across Africa, Europe and Asia-Pacific (APAC). The result is predictable performance. Some services already reach past South Africa. FirstNet's LEO satellite service, on Eutelsat OneWeb, is offered in South Africa and across Africa. International traffic runs over multi-peer transit at hubs such as London, New York, Frankfurt and Singapore. For sites outside South Africa, expect a scoping step before pricing. That is because licensing and partner deals differ by country. Within South Africa, FirstNet gives you one partner, one contract and one SLA across all your sites. URL: https://www.firstnet.co.za/knowledge/connectivity/do-you-support-multi-country-deployments/. Reviewed 2026-10-10. #### Does Peplink bonded connectivity from FirstNet lock us into one carrier? No. Peplink uses standard SIM cards and standard fibre handoffs and supports any carrier, so you can mix fibre, LTE/5G, microwave and satellite from different providers at each site. Mixing carriers is the point of bonding: if every link at a site rides the same network, a single outage can take them all down. FirstNet's site survey picks the carrier and technology mix that bonds best at each location, based on: - Carrier diversity - Mobile coverage at the site - Fibre availability - Satellite line of sight - Power and UPS requirements FirstNet itself is carrier-agnostic, with reach across every major fibre network operator and mobile network operator in South Africa. It can supply the fibre, DIA, LTE/5G and LEO satellite links, or bond links you already have. Because the hardware uses standard SIMs and handoffs, changing a carrier later means changing the circuit or SIM rather than the bonding platform. The hardware range is flexible too: Balance series routers for branches and head offices, MAX series for vehicles and rugged sites, BR1/BR2 Mini for small branches, ATMs and POS, and EPX for hubs aggregating many branches. URL: https://www.firstnet.co.za/knowledge/connectivity/does-peplink-lock-us-into-one-carrier/. Reviewed 2026-10-10. #### Does Peplink bonding from FirstNet double our internet speed? Not always. Bonding adds resilience and aggregate throughput up to the sum of the links, but per-flow protocol behaviour, the SpeedFusion mode in use and encryption overhead all affect the result. FirstNet sizes the design on your real peak application needs. Why the result is not simply link A plus link B: - Aggregate ceiling: the theoretical maximum is the combined capacity of the bonded links. - Protocol behaviour: individual traffic flows do not always scale evenly across links with different speeds and latency. - SpeedFusion mode: WAN Smoothing, for example, sends duplicate packets across links to cut loss for real-time traffic, which uses capacity to gain quality. - Encryption overhead: bonded tunnels carry encryption, which consumes some capacity. Where bonding clearly helps is continuity. Peplink SpeedFusion treats several WAN links as one virtual link and splits a single flow across them, so if fibre drops, a live call continues on LTE or satellite. Active TCP and UDP sessions, including SIP, RTP and RDP, survive a link cut with sub-second hot failover. FirstNet's per-site survey covers signal mapping, fibre availability, power and UPS sizing, and hardware is sized by throughput, ports, cellular modems and environment. URL: https://www.firstnet.co.za/knowledge/connectivity/does-bonding-double-our-speed/. Reviewed 2026-10-10. #### Does a FirstNet microwave internet link need line of sight? Yes. Microwave broadband is a licensed radio link from a high site or tower to your premises, so it always needs a line-of-sight and radio-frequency (RF) assessment, first from the desktop and then physically where required. Trees, buildings, terrain and lack of rooftop access can prevent delivery. How FirstNet takes a microwave link from enquiry to live: - Desktop assessment of line of sight and RF - Physical survey at your site where required - Confirmation of the mounting position, power and access - Installation of an outdoor radio or antenna on a roof, wall or mast, plus an indoor router - PRTG monitoring once the link is handed over Once line of sight is confirmed, installation can follow within weeks. Microwave can be point-to-point or point-to-multipoint, and is delivered only through ICASA-licensed operators on approved spectrum with type-approved equipment. If line of sight is not available, FirstNet moves on to fixed wireless, then LTE/5G, and finally LEO satellite, which needs a clear view of the sky rather than a line-of-sight relay to a tower. URL: https://www.firstnet.co.za/knowledge/connectivity/does-a-microwave-internet-link-need-line-of-sight/. Reviewed 2026-10-10. #### Does a Peplink router from FirstNet replace our firewall? No. Peplink is the SD-WAN edge that bonds and manages your links. FirstNet pairs it with FirstNet firewall-as-a-service for perimeter security. The roles are separate: - Peplink: bonds fibre, LTE/5G, microwave and satellite into one virtual link, with sub-second failover, Forward Error Correction and WAN Smoothing. - Firewall-as-a-service: provides perimeter security, delivered by FirstNet. - InControl 2: cloud management for the Peplink estate, run by FirstNet. - FirstNet NOC: day-2 monitoring and ticketing across the edge. Keeping connectivity and security as distinct functions lets each do its job, while one provider manages both. It also fits FirstNet's broader approach: firewalls, segmentation, secure access and traffic control must align with the network design and be applied consistently across sites. For multi-site retail and QSR estates, centralised policy gives a consistent posture across hundreds of sites while keeping POS and payments running. If you already run your own firewall, raise it during the per-site survey so the design accounts for it alongside power, link selection and hardware sizing. URL: https://www.firstnet.co.za/knowledge/connectivity/does-peplink-replace-our-firewall/. Reviewed 2026-10-10. #### Does my business need a redundant or backup internet connection? If downtime affects revenue or operations, yes. FirstNet treats a primary link plus a diverse backup as the default design for revenue-impacting sites, because even business fibre can fail through last-mile cuts, provider outages or congestion. The level of redundancy should match your risk. FirstNet sizes it by asking what happens if the internet is down for two hours, or a full day: - Single primary link: for non-critical sites where some downtime is tolerable and the risk is consciously accepted. - Primary plus diverse backup: fibre paired with licensed microwave, fixed wireless or LTE for fast failover. - Dual fibre on different carriers: ideally on diverse physical routes, for high bandwidth and carrier redundancy. - SD-WAN across two diverse links: typically one fibre and one wireless, with automatic failover and traffic steering. - LEO satellite: an independent path for remote or highly critical sites. Diversity is what makes a backup useful. A second link on the same network or in the same trench can fail with the primary, so FirstNet, as a carrier-agnostic provider, places backups on different carriers or media. A fibre cut needs physical repair, and a well-designed backup keeps traffic flowing while that happens. URL: https://www.firstnet.co.za/knowledge/connectivity/do-i-need-redundancy/. Reviewed 2026-10-10. #### Does weather affect FirstNet LEO satellite connectivity? Like all satellite technologies, LEO connectivity can be affected by severe weather conditions. Where business continuity is critical, FirstNet incorporates LEO into a multi-link design, using additional connectivity paths and intelligent failover to improve overall resilience. Weather is one of several site factors FirstNet plans around: - Severe weather: can affect the satellite signal, as with any satellite service. - Obstructions: dense tree canopy or structures in the antenna's field of view can affect performance, so they are validated during site readiness. - Mounting and power: a secure mounting position and power at the installation point. - Diversity: pairing LEO with fibre, LTE/5G or microwave means a weather event does not have to take the site offline. When LEO is integrated with SD-WAN, traffic can fail over automatically between LEO, fibre, LTE/5G and other available connections. With Peplink bonding, satellite and LTE/5G run in parallel, so live sessions continue if one path degrades. The aim is resilience by design: no single medium is perfect, but links that fail for different reasons rarely fail at the same moment. FirstNet monitors the LEO link as part of the managed environment. URL: https://www.firstnet.co.za/knowledge/connectivity/does-weather-affect-leo-satellite-connectivity/. Reviewed 2026-10-10. #### Does weather affect FirstNet licensed microwave links? Higher-frequency microwave links can be weather-sensitive. FirstNet accounts for this in the survey and design, and can pair microwave with another medium for resilience. In general, heavy rain absorbs and scatters radio signals, and the effect grows at higher frequencies and over longer distances, so a microwave link is engineered with its path, frequency and conditions in mind. For FirstNet microwave this means: - A desktop and physical line-of-sight and RF assessment before anything is committed - Delivery only through ICASA-licensed network operators on approved spectrum - ICASA type-approved radios and antennas, mounted on a roof, wall or mast - PRTG monitoring through the indoor router once the link is live Weather is one reason FirstNet treats diversity as a design principle. Microwave is often the backup to fibre, because an air path does not share fibre's trench and is unaffected by cable cuts. Where microwave is the primary, pairing it with LTE/5G, fixed wireless or LEO satellite gives a second path. LEO satellite can also be affected by severe weather, so the right pairing depends on the site and is decided during design. URL: https://www.firstnet.co.za/knowledge/connectivity/does-weather-affect-microwave-links/. Reviewed 2026-10-10. #### How do I find out if FirstNet business fibre is available at my address? FirstNet runs a feasibility check on your exact site address across every fibre network operator that may serve it, then confirms the result with a quote from the last-mile provider. GPS coordinates help, especially for new developments and rural sites. How the check works: - You supply the site address, and GPS coordinates where available. - FirstNet checks the address against the fibre network operators that may serve it, such as Vumatel, Frogfoot, Openserve and MetroFibre. - The last-mile provider confirms feasibility with a quote. - FirstNet comes back with the result and a realistic timeline. Feasibility outcomes can change once detailed planning is done, for example when wayleaves, landlord approvals or construction routes are worked out. Where fibre is not feasible, FirstNet assesses licensed microwave, then fixed wireless, then LTE/5G and, as a last resort, LEO satellite, validating each option for your exact address before installation. Because FirstNet is carrier-agnostic, one check covers multiple networks rather than a single operator's footprint. A FirstNet specialist can run feasibility for one site or for a full list of branches. URL: https://www.firstnet.co.za/knowledge/connectivity/how-do-i-find-out-if-business-fibre-is-available-at-my-address/. Reviewed 2026-10-10. #### How do SLAs and service credits work on FirstNet Dedicated Internet Access? FirstNet DIA service levels are last-mile dependent and strictly aligned to the underlying carrier's commitments, with response and resolution targets following the contracted carrier SLA. Service credits are passed through from the carrier once validated against that SLA, and your specific targets are set out in your contract. How it works in practice: - Targets: response and resolution targets mirror the carrier SLA for your site's last mile. - Validation: when an outage occurs, FirstNet validates it against the carrier's SLA. - Credits: service credits are passed through to you once validated with the carrier. - Escalation: FirstNet manages the full escalation path on your behalf, so you do not deal with the carrier directly. Aligning SLAs to the carrier means the commitment matches what the underlying last mile can actually deliver. What DIA adds over broadband is the service specification: dedicated 1:1 contention, symmetric committed bandwidth, and predictable latency, jitter and packet loss. Where even a carrier-backed SLA is not enough, the answer is design. Dual-homed DIA, or DIA with broadband failover, gives layered resilience so a single last-mile fault does not take the site offline. URL: https://www.firstnet.co.za/knowledge/connectivity/how-do-slas-and-service-credits-work-on-dedicated-internet-access/. Reviewed 2026-10-10. #### How do service levels and service credits work on FirstNet business broadband links? Availability targets and service credits on broadband follow the underlying last-mile provider's SLA. Credits are passed through once FirstNet receives them from the carrier, and FirstNet handles fault escalation, SLA validation and the credit claim on your behalf. You do not have to chase the fibre or wireless operator yourself, because FirstNet is the single escalation point across all underlying providers. In practice: - The fault is picked up by monitoring or logged by you with FirstNet support. - FirstNet's NOC works the fault with the carrier through to restoration. - FirstNet validates the outage against the carrier's SLA. - FirstNet submits the credit claim and passes the credit through once the carrier pays it. Targets differ by access type. Business fibre carries availability targets up to 99.5% on premium networks and 99% on standard. Fixed wireless usually targets up to about 99%, with next-business-day restoration as standard. LTE/5G is best-effort with no fixed uptime SLA. Your exact targets are set out in your contracted service terms. Service credits compensate for downtime but do not prevent it, so for revenue-impacting sites FirstNet recommends a diverse backup link as well. URL: https://www.firstnet.co.za/knowledge/connectivity/how-do-service-levels-work-on-broadband-links/. Reviewed 2026-10-10. #### How does FirstNet decide which connectivity technology each business site gets? FirstNet checks fibre first for every fixed site. Where fibre is not feasible, it works through licensed alternatives in a set order: licensed microwave, then fixed wireless (FWA / Fixed 5G), then LTE/5G, with LEO satellite as the last resort. FirstNet is carrier- and medium-agnostic, so the choice is driven by coverage, performance and resilience at your exact address rather than by one network's footprint. The options, in order: - Fibre: the default primary for fixed sites, symmetric or asymmetric and uncapped, with dedicated uncontended options for critical sites. - Licensed microwave: point-to-point or point-to-multipoint radio for sites without fibre, or an air-path backup that does not share fibre's trench. - Fixed wireless (FWA / Fixed 5G): packaged fixed wireless access over fixed 5G or approved partner platforms. - LTE/5G: carrier-agnostic mobile broadband, often live within a few working days. - LEO satellite: licensed low-Earth-orbit service via Eutelsat OneWeb for remote sites where no terrestrial option fits. Temporary and mobile sites are the exception. There FirstNet leads with LTE/5G because it deploys fastest, and a fibre primary can be built in parallel for sites that will stay. How critical the site is then decides whether a second, diverse link is added. A FirstNet specialist can run feasibility on your site addresses. URL: https://www.firstnet.co.za/knowledge/connectivity/how-do-you-decide-which-technology-a-site-gets/. Reviewed 2026-10-10. #### How does FirstNet handle DDoS attacks on its ISP network? FirstNet blends upstream filtering with on-net protections to mitigate distributed denial-of-service (DDoS) attacks swiftly, and applies DDoS protection and access controls at key points in its network. A DDoS attack floods a target with traffic from many sources to overwhelm its link or services. Filtering upstream, closer to where that traffic enters, removes much of it before it reaches your connection, while on-net protections deal with what remains. These controls sit within FirstNet's wider backbone design: its own Autonomous System with diverse, multi-homed upstreams, peering at NAPAfrica, JINX, CINX and DINX, a 24/7 NOC with telemetry, alerts and real-time dashboards, and ITIL-aligned incident management. Ask FirstNet to confirm the mitigation scope and any DDoS-related service commitments for your specific service during design. For protection of websites and applications, FirstNet's hosted firewall and network security services can be scoped alongside the connectivity. URL: https://www.firstnet.co.za/knowledge/connectivity/how-do-you-handle-ddos/. Reviewed 2026-10-10. #### How does FirstNet monitor business internet links? Every FirstNet-managed router is added to FirstNet's PRTG monitoring platform, with SNMP-based up/down alerting and bandwidth monitoring. FirstNet's Network Operations Centre (NOC) responds to incidents and works with the carrier on repairs. Monitoring starts at handover: once installation and testing are complete, the link moves to the NOC for proactive monitoring and incident response. FirstNet monitors business connectivity environments on a 24x7 basis and looks at real-world performance rather than simple line availability, including: - Latency, packet loss and jitter - Link utilisation and bandwidth trends - Early signs of degradation and emerging faults - Automated alerting and escalation when thresholds are breached - Coordinated fault management across multiple providers and technologies Monitored links also come with alerts and monthly service reviews. The managed router is what makes this possible: it is FirstNet's view into the link, which is why FirstNet's standard is a managed router with your own firewall connected behind it. For context, SNMP (Simple Network Management Protocol) is the standard way network devices report their status, and PRTG is the monitoring system that collects those readings and raises alerts. URL: https://www.firstnet.co.za/knowledge/connectivity/how-are-our-links-monitored/. Reviewed 2026-10-10. #### How does FirstNet route business traffic to cloud services hosted overseas? FirstNet sends international traffic over multi-peer transit at global hubs such as London, New York, Frankfurt and Singapore. It uses several undersea cable systems and reroutes traffic automatically if one is cut. Performance to an overseas cloud region depends on where traffic leaves South Africa and how it is routed. Here is how FirstNet handles it: - Multi-peer transit at hubs such as LINX London, New York, Frankfurt and Singapore. There are more peering points too, such as Amsterdam, Marseille and São Paulo. - Capacity on seven or more undersea cables, such as WACS, EASSy, SEACOM and 2Africa. - Automatic rerouting when a cable is cut or a region is congested. - Direct peering with Microsoft, AWS, Google Cloud and major content delivery networks. On standard business fibre, international contention is capped at 1:4 at most, and only during undersea cable failures. If international cloud performance is critical, Dedicated Internet Access (DIA) gives you a dedicated 1:1 contention on international traffic. DIA peers in hubs such as London, New York, Brazil, Germany, Marseilles and Singapore. A move to overseas cloud platforms is a common reason to upgrade core sites from broadband to DIA. For those sites, stable international routing matters more than headline speed. URL: https://www.firstnet.co.za/knowledge/connectivity/what-about-cloud-services-hosted-overseas/. Reviewed 2026-10-10. #### How fast is FirstNet fixed wireless access (FWA / Fixed 5G)? Fixed wireless speeds depend on the technology and the distance from the site, with common profiles ranging from about 5 to 10 Mbps up to 100 Mbps or more. Services are typically asymmetric, with faster download than upload, and often uncapped. What else to know about FirstNet fixed wireless: - It is a packaged fixed-site service delivered over fixed 5G or approved partner platforms. - It is contended and best-effort, so speeds can vary with load on the network. - It usually carries an availability target of up to about 99%, with next-business-day fault restoration as standard. - It typically includes one static public IP. - A coverage and capacity check, or a site survey, confirms what is achievable at your address, including whether an indoor or outdoor unit is needed. Fixed wireless is the next option FirstNet assesses after licensed microwave for a fixed site without fibre, and it is also used as cost-effective failover for a fibre primary. If you need consistent speeds with stronger service levels, licensed microwave or fibre is preferred where feasible, and Dedicated Internet Access gives committed, symmetric bandwidth. URL: https://www.firstnet.co.za/knowledge/connectivity/how-fast-is-fixed-wireless-access-fwa-fixed-5g/. Reviewed 2026-10-10. #### How is FirstNet Dedicated Internet Access (DIA) different from business broadband? FirstNet DIA gives you uncontended, symmetric, committed bandwidth with SLA-backed performance and engineered international routing. Business broadband is shared and best-effort, with SLAs set by the last-mile provider. Side by side: - Contention: DIA has dedicated 1:1 contention on local and international traffic; broadband may be contended, although FirstNet business fibre is uncontended on local on-net traffic. - Bandwidth: DIA is symmetric and committed and does not degrade at peak; broadband throughput can vary with wider internet conditions. - Performance: DIA is engineered for predictable latency, jitter and packet loss. - Service levels: DIA has defined SLAs with service credits aligned to the carrier; broadband carries best-effort, last-mile SLAs. - Delivery: DIA runs over approved fibre as a Layer 3 service into the FirstNet core, with static public IP addressing and enterprise routing. DIA suits core sites, head offices, data centres and hubs where downtime has material impact. Broadband is ideal for branches and as a cost-effective backup to DIA. Many organisations combine the two: DIA at the head office or SD-WAN hub, broadband at branches, and broadband failover behind the DIA for layered resilience. URL: https://www.firstnet.co.za/knowledge/connectivity/how-is-dia-different-from-business-broadband/. Reviewed 2026-10-10. #### How is FirstNet IP Transit sold and contracted? FirstNet IP Transit is a capacity-based wholesale service, usually on longer-term agreements, with the exact term and renewal confirmed during commercial engagement. Support and service commitments cover the FirstNet transit domain, backbone and ports, while your routing policy remains your responsibility. What you are buying is uncontended transit capacity: a Layer 3, BGP-based service that gives your Autonomous System access to the global routing table through FirstNet's upstream and peering ecosystem. The service can grow with you, and common upgrades include: - More capacity as traffic grows - Redundant ports or dual paths - IPv6 enablement - Protected IP Transit, a FirstNet-engineered redundant service design To qualify, you need a public ASN, a router running BGP v4, and IPv4 and/or IPv6 support. Onboarding runs through ASN validation, port provisioning, BGP set-up and end-to-end testing before handover. The service suits ISPs and WISPs, hosting, cloud and data centre operators, CDNs, and enterprises with in-house network engineering, and can be your only upstream or one of several. If you need managed internet for offices rather than wholesale transit, Dedicated Internet Access is the better fit. URL: https://www.firstnet.co.za/knowledge/connectivity/how-is-ip-transit-sold/. Reviewed 2026-10-10. #### How is FirstNet LEO satellite different from traditional geostationary satellite (VSAT)? LEO (low-Earth-orbit) satellites orbit much closer to Earth than geostationary ones, so latency is far lower. FirstNet LEO typically runs at around 50 to 80 ms, which keeps voice, video calls, cloud platforms and remote access responsive. For context, geostationary satellites sit roughly 36,000 km above the equator. LEO satellites orbit at a small fraction of that height, which is why the delay drops so sharply. As a result, LEO works for interactive cloud apps and calls that struggle on older satellite links. FirstNet's enterprise LEO service runs on Eutelsat OneWeb. It is delivered in South Africa through ICASA-licensed partner arrangements, and it is a very different experience from legacy geostationary VSAT: - Typical latency of around 50 to 80 ms - Speeds of up to 100 Mbps download and 20 Mbps upload, depending on your service profile - Support for SD-WAN, VoIP, cloud apps and video - Available in South Africa and across Africa - Managed installation, monitoring and support included The physical setup differs too. LEO satellites move across the sky rather than sitting in one fixed position, so the antenna needs a broad, clear view of the sky rather than a single line of sight to one point. Dense tree canopy or structures in the antenna's field of view can affect performance, and like all satellite technologies, LEO can be affected by severe weather. FirstNet validates the site before installing, checking for: - A clear view of the sky, usually a roof or open area - A secure mounting position and power at the installation point - Site access, including permits or safety inductions - Accurate GPS coordinates that plot to the installation roof The commercial model is flexible. Business plans run up to 100/20 Mbps with no fair-usage policy, on month-to-month or fixed terms. Data can be pooled across multiple sites, or a link can sit on standby so you only pay for data when you use it. For events, FirstNet installs the day before and removes it the day after, with no contractual commitment. Where LEO fits: - Off-grid primary, where fibre is absent, unreliable or has prohibitive lead times - Hybrid failover, with fibre as the primary and LEO as a backup that does not share fibre's failure modes - SD-WAN path diversity, as an independent underlay alongside fibre or LTE/5G - Multi-site estates such as ATMs, point-of-sale sites, clinics and branches LEO is not a fibre replacement. Where viable fibre exists, it remains the better primary for speed, latency and consistency, and FirstNet checks fibre, microwave, fixed wireless and LTE/5G before recommending LEO as a primary link. FirstNet treats LEO as part of a managed network, not a standalone dish. It links LEO with fibre, LTE/5G, SD-WAN and security, with one accountable partner. It uses only ICASA-licensed services, never grey-market satellite, and usually returns a quote within one business day after checking coverage and licensing for your site. URL: https://www.firstnet.co.za/knowledge/connectivity/how-is-leo-different-from-traditional-satellite/. Reviewed 2026-10-11. #### How is FirstNet business fibre different from home fibre? FirstNet business fibre is uncontended on local traffic, carries last-mile uptime targets with a service-credit schedule, and includes a FirstNet-managed router, PRTG monitoring and 24x7 NOC support. Consumer-grade services generally lack the SLAs, real-time monitoring and dedicated support a business depends on. What FirstNet business fibre includes: - Symmetric or asymmetric, uncapped service - Uncontended on local (on-net) traffic, with international contention capped at 1:4 and only during undersea cable failures - Availability targets up to 99.5% on premium networks and 99% on standard - Up to two static public IPs by default, useful for VPN or remote access - A FirstNet-managed router monitored through PRTG - Dedicated, uncontended variants for mission-critical sites The bigger difference is accountability. FirstNet designs fibre around what each site runs, whether that is Microsoft 365, voice, CCTV, ERP or point-of-sale, coordinates the underlying fibre provider and drives escalations through to resolution. It can also add a diverse backup on LTE/5G, microwave or LEO satellite so a fibre cut does not take the site offline. Note that standard business fibre is still best-effort beyond FirstNet's core network; committed bandwidth comes with Dedicated Internet Access. URL: https://www.firstnet.co.za/knowledge/connectivity/how-is-business-fibre-different-from-home-fibre/. Reviewed 2026-10-10. #### How is FirstNet direct cloud peering different from a VPN to the cloud? FirstNet direct cloud peering gives your traffic a path into Microsoft and AWS that skips the public internet, so latency is lower and performance steadier. A VPN is an encrypted tunnel that still runs over the public internet, so it suffers the internet's ups and downs. The practical differences: - Path: FirstNet peering links its network straight to Microsoft (including Azure and Microsoft 365), AWS, Google Cloud and major content delivery networks. A VPN takes whatever internet route it can get. - Performance: peering uses dedicated routes with built-in headroom that avoid internet congestion. VPN performance varies with congestion and route changes. - Security: peering cuts exposure and supports policy-based access to cloud resources. A VPN relies on encryption to protect traffic on a shared network. - Control: peering plugs into FirstNet's private connectivity and security services, for a design you control from end to end. You can use both. Encryption still works over a peered path, and a VPN remains useful for remote users. Direct peering suits real-time apps, data replication and latency-sensitive services, where predictable performance matters most. FirstNet starts with an assessment that sets a baseline of your current latency and traffic patterns. URL: https://www.firstnet.co.za/knowledge/connectivity/how-is-peering-different-from-vpn/. Reviewed 2026-10-10. #### How is Peplink bonded connectivity different from traditional 4G failover? Traditional failover is cold standby: fibre drops, 4G takes over, and live calls redial. Peplink runs fibre and LTE in parallel, so when the fibre fails, more traffic simply shifts to LTE without breaking the session. The difference comes from how Peplink SpeedFusion works: - Packet-level bonding: one flow rides multiple links at the same time, not one link per session. - Sub-second hot failover: active TCP and UDP sessions, including SIP, RTP and RDP, survive a link cut. - Forward Error Correction: recovers lost packets without retransmission, keeping voice and video clean on noisy links. - WAN Smoothing: sends duplicate packets across bonded links for ultra-low-loss real-time traffic. In practice, a VoIP or Teams call, a remote desktop session or a payment in progress continues when the fibre goes, rather than dropping and restarting. This is what lets a bonded edge ride through load-shedding, fibre cuts and tower failures. FirstNet delivers it as a managed service: per-site survey, link selection for carrier and technology diversity, hardware sizing, InControl 2 cloud management run by FirstNet, and day-2 monitoring and ticketing through the FirstNet NOC. URL: https://www.firstnet.co.za/knowledge/connectivity/how-is-this-different-from-4g-failover/. Reviewed 2026-10-10. #### How long does FirstNet Dedicated Internet Access take to install? Lead times for FirstNet DIA depend on the carrier and your site, and are confirmed during feasibility. Onboarding runs through qualification, last-mile feasibility, provisioning and installation, then handover to support. The steps in more detail: - Qualification: FirstNet confirms that DIA is the right fit for the site, rather than business broadband. - Last-mile feasibility: carrier feasibility on approved fibre from ICASA-licensed operators is confirmed for your address. - Provisioning: carrier orders are placed and approvals coordinated. - Installation: the fibre access and the Layer 3 service into the FirstNet core are installed and tested. - Handover to support: the service moves to FirstNet's support and NOC teams. DIA is delivered over fibre, so the factors that drive fibre lead times apply: construction, wayleaves and landlord approvals, with the clock starting once approvals are in place. FirstNet gives a realistic timeline up front rather than a generic figure. If a site must go live before the DIA circuit is ready, a temporary LTE/5G link can usually be deployed within days. Once DIA is live, business broadband can serve as a cost-effective backup. URL: https://www.firstnet.co.za/knowledge/connectivity/how-long-does-dia-take-to-install/. Reviewed 2026-10-10. #### How long does FirstNet take to fix a business internet fault? Restoration time depends on the last mile: a fibre cut needs physical repair, while a microwave link may need realignment or site access. That is why FirstNet designs a diverse backup for critical sites, so traffic fails over while the primary fault is worked. What sets the pace of a repair: - Fibre: physical cuts and cable theft need the network operator to repair the cable. - Licensed microwave: may need realignment, or access to your site or the high site. - Fixed wireless: next-business-day fault restoration is the usual standard. - LTE/5G: not affected by fibre cuts or cable theft, but can be affected by tower power outages and local radio interference. FirstNet's role is to shorten the process. Managed routers are monitored on PRTG, the NOC works the fault with the carrier, and FirstNet acts as the single escalation point across all underlying providers. Response and restoration targets, where they apply, follow the underlying carrier's SLA and are set out in your contract. Standard broadband support runs in business hours with after-hours callout for severity 1 issues. For sites where even a few hours offline is costly, the practical answer is a second link on a different carrier or medium. URL: https://www.firstnet.co.za/knowledge/connectivity/how-long-does-a-fault-take-to-fix/. Reviewed 2026-10-10. #### How long does a FirstNet SD-WAN rollout take? There is no single standard lead time for SD-WAN. Timelines depend on underlay availability at each site, site readiness, whether a hybrid MPLS design is needed, and the overall rollout scope. The rollout follows five stages: - Outcomes: capture your business, resilience and security objectives. - Underlay feasibility: validate multi-link requirements and link quality at each site. - Joint validation: FirstNet's Connectivity and Security teams both validate the architecture and overlay. - Rollout and testing: provision and test the approved design across the selected underlays. - Managed service: hand over to managed services for in-life support and governance. Underlays usually set the pace. A new fibre link typically takes several weeks to months, depending on construction and approvals, while LTE/5G is often live within a few working days and microwave can follow within weeks once line of sight is confirmed. For comparison, FirstNet's Peplink bonded service, which follows a similar survey-led approach, typically takes four to six weeks for a single site, and a 50-site rollout typically runs four to six months in phased waves. FirstNet confirms a site-by-site plan once underlay feasibility is complete. URL: https://www.firstnet.co.za/knowledge/connectivity/how-long-does-an-sd-wan-rollout-take/. Reviewed 2026-10-10. #### How long does a FirstNet business fibre installation take? Typically several weeks to months, depending on construction, wayleaves and landlord approvals. If you need to open sooner, FirstNet can deploy LTE/5G in days while the fibre is built. The fibre clock starts once approvals are in place, so lead time is driven as much by consents as by construction. Every link follows the same delivery path: - Order intake: FirstNet confirms the signed service schedule, scope and your key contacts. - Feasibility validation: feasibility and the carrier quote are confirmed for your exact address. - Provisioning: carrier orders are placed and landlord, wayleave and municipal approvals coordinated. - Install and test: the carrier installs, and FirstNet sets up and tests the managed router. - Service handover: you receive a Service Handover Form within two business days of install, with two business days to test. - Monitoring begins: the link moves to FirstNet's NOC. You can shorten the wait by arranging landlord or body corporate consent, site access and power early. For a site that must open on a fixed date, LTE/5G is often live within a few working days on a minimum six-month term without an SLA, and can stay on as a backup once the fibre is live. URL: https://www.firstnet.co.za/knowledge/connectivity/how-long-does-a-fibre-installation-take/. Reviewed 2026-10-10. #### How many static IP addresses come with FirstNet business fibre? FirstNet business fibre includes up to two static public IP addresses by default: one is used on the FirstNet-managed router and one is available for your own use, for example for VPN or remote access. Additional public IPs can be added as an option as your site grows. A static public IP is an internet address that does not change, which is what remote-access VPNs, hosted services and firewall rules usually rely on. How FirstNet handles addressing: - Two static public IPs by default on business fibre - Additional public IPs available as an optional extra - All allocated IP addresses remain the property of FirstNet - Dedicated Internet Access also includes static public IP addressing and enterprise routing Other access types differ. Fixed wireless typically includes one static public IP. On LTE/5G a static IP is available as an option, and FirstNet recommends it for VPN or remote access, because the default on mobile networks may be shared, dynamic addressing behind carrier-grade NAT (CGNAT). Raise your addressing needs during design, where VLAN tagging and the IP scheme are confirmed, so they are scoped with the link. URL: https://www.firstnet.co.za/knowledge/connectivity/how-many-static-ip-addresses-come-with-business-fibre/. Reviewed 2026-10-10. #### How quickly can FirstNet add new sites to our connectivity network? FirstNet uses standardised processes and templates to accelerate provisioning and turn-up, so new sites follow a predictable path rather than a fresh project each time. How fast an individual site goes live depends mainly on its last-mile technology and approvals. Typical lead times by access type: - LTE/5G: often live within a few working days - Licensed microwave: installation can follow within weeks once line of sight is confirmed - Fixed wireless: depends on coverage and capacity at the address - Fibre: typically several weeks to months, depending on construction, wayleaves and landlord approvals - LEO satellite: generally faster to deploy than a new fibre build Every link follows the same sequence: order intake, feasibility validation, provisioning, install and test, service handover, then NOC monitoring. To open a site before its fibre is ready, FirstNet can use the temporary wireless first pattern: LTE/5G in days, with the fibre primary built in parallel. URL: https://www.firstnet.co.za/knowledge/connectivity/how-fast-can-we-add-sites/. Reviewed 2026-10-10. #### How quickly can FirstNet connect a business site with LEO satellite? LEO can generally be deployed faster than a new fibre build, which makes it well suited to remote, temporary and newly established sites. Actual deployment times depend on the site requirements, equipment availability and installation conditions. What sets the timeline: - Quote: FirstNet checks coverage and licensing for the location and usually comes back with a quote within one business day. - Site readiness: a clear view of the sky, a secure mounting position, power, access and accurate GPS coordinates. - Install slot: once readiness is confirmed, an installation is booked. - Installation: the antenna is installed, the service activated and monitoring enabled. - Handover: support contacts, ticket channels and escalation path are confirmed. LEO needs no tower build and no line-of-sight relay, so it can activate faster than microwave in remote regions, difficult terrain and long-distance or temporary deployments. It also avoids the fibre construction, wayleaves and civil works that drive fibre lead times. For events, FirstNet installs LEO the day before and removes it the day after, with no contractual commitment. For new sites, LEO can connect the location while permanent infrastructure is being deployed. URL: https://www.firstnet.co.za/knowledge/connectivity/how-quickly-can-a-site-be-connected/. Reviewed 2026-10-10. #### How reliable is business fibre internet in South Africa? Business fibre is highly reliable and is the primary connectivity medium for most businesses, but it is not immune to failure. Last-mile cuts, provider outages and congestion still happen, so FirstNet recommends managed redundancy alongside fibre at any site where downtime costs revenue. What FirstNet business fibre includes: - Symmetric or asymmetric, uncapped service, uncontended on local (on-net) traffic - A FirstNet-managed router monitored through PRTG, with 24x7 NOC support - Availability targets up to 99.5% on premium networks and 99% on standard networks, with a service-credit schedule - International contention capped at 1:4, and only during undersea cable failures - Dedicated, uncontended variants for mission-critical sites Reliability in practice also depends on how quickly a fault is restored. A fibre cut needs physical repair, so FirstNet pairs fibre with a diverse backup on revenue-impacting sites: licensed microwave for air-versus-trench diversity, LTE/5G or fixed wireless for fast failover, or a second fibre on another carrier. LTE/5G is not affected by fibre cuts or cable theft, which makes it a strong fibre backup. Because last-mile quality and repair times vary by region and provider in South Africa, FirstNet designs across multiple providers rather than relying on one. URL: https://www.firstnet.co.za/knowledge/connectivity/how-reliable-is-fibre/. Reviewed 2026-10-10. #### How should I compare business internet quotes from different South African providers? Compare like for like rather than on monthly cost alone. Check whether each quote includes a written uptime SLA with service credits, a backup link on a different network, a managed and monitored router, 24x7 monitoring, and a defined support and escalation path. Lower-cost offers often leave out exactly the things you only notice when something breaks, so ask each provider to set out its inclusions side by side. Useful questions: - Is the service contended, and is local (on-net) traffic uncontended? - How many static public IPs are included, and who owns the router? - What availability target applies, and how are service credits claimed? - Which support hours apply, and is there after-hours callout for severity 1 faults? - Is international traffic carried on several undersea cables with automatic rerouting? - What are the contract term and notice period? As a reference point, standard FirstNet business fibre is uncapped, uncontended on local on-net traffic, includes a FirstNet-managed router with PRTG monitoring and up to two static public IPs by default, and carries availability targets of up to 99.5% on premium networks and 99% on standard. If you need committed bandwidth, compare Dedicated Internet Access quotes rather than broadband. URL: https://www.firstnet.co.za/knowledge/connectivity/how-should-i-compare-business-internet-quotes-from-different-providers/. Reviewed 2026-10-10. #### Is FirstNet Dedicated Internet Access the same as IP Transit? No. DIA is a managed enterprise internet service for offices and core sites. IP Transit is a wholesale, BGP-based service for organisations that run their own Autonomous System and manage their own routing. How they differ: - Who it is for: DIA suits head offices, data centres, hubs and regulated sites; IP Transit suits ISPs and WISPs, hosting, cloud and data centre operators, CDNs, and enterprises with in-house network engineering. - Requirements: DIA needs no ASN; IP Transit needs a public ASN, a router running BGP v4, and IPv4 and/or IPv6 support. - Routing: with DIA, FirstNet manages routing and you receive static public IP addressing; with IP Transit, you control routing policy and traffic engineering. - Support boundary: DIA is managed end to end by FirstNet; IP Transit support covers FirstNet's transit domain, backbone and ports, while routing policy remains yours. - Delivery: DIA is a Layer 3 service into the FirstNet core over approved fibre; IP Transit gives your Autonomous System access to the global routing table through FirstNet's upstream and peering ecosystem. If you do not have your own ASN or in-house routing expertise, DIA is the right managed choice. Both are uncontended services on FirstNet's own network. URL: https://www.firstnet.co.za/knowledge/connectivity/is-dia-the-same-as-ip-transit/. Reviewed 2026-10-10. #### Is FirstNet IP Transit suitable for office internet? No. IP Transit is a wholesale, BGP-based service for organisations that run their own network, hold a public ASN and want to control routing and traffic engineering themselves. If you want FirstNet to manage the internet service for offices or branches, Dedicated Internet Access or business broadband is the right fit. Why IP Transit is the wrong tool for a typical office: - It needs a public ASN, a router running BGP v4, and in-house routing expertise. - Routing policy, traffic engineering, ASN and IP space compliance are your responsibility. - FirstNet's support covers the transit domain, backbone and ports, not your network beyond them. IP Transit is built for ISPs and WISPs, hosting, cloud and data centre operators, CDNs, and enterprises with in-house network engineering. For offices, choose by how critical the site is. Dedicated Internet Access gives head offices and core sites dedicated 1:1 contention, symmetric committed bandwidth, static public IPs and defined SLAs, managed end to end by FirstNet. Business broadband suits branches and serves as a cost-effective backup to DIA. In both cases FirstNet supplies the managed router, monitors the link and handles carrier escalation for you. URL: https://www.firstnet.co.za/knowledge/connectivity/is-ip-transit-suitable-for-office-internet/. Reviewed 2026-10-10. #### Is FirstNet LEO satellite as fast as fibre? No. Fibre remains the preferred option for speed, latency and consistency where it is available. LEO provides a strong business-grade alternative where fibre is not feasible, and an independent connectivity path alongside fibre where greater resilience is required. How the two compare: - LEO: typical latency of around 50 to 80 ms, and speeds up to 100 Mbps download and 20 Mbps upload depending on the service profile. - Business fibre: symmetric or asymmetric and uncapped, uncontended on local on-net traffic, with dedicated options for critical sites. - Site conditions: LEO needs a clear view of the sky and, like all satellite technologies, can be affected by severe weather. LEO's strength is reach and independence rather than raw speed. It brings mines, farms, lodges, depots, regional branches and temporary project sites online without waiting for fibre construction, wayleaves or extensive civil works, and it supports cloud platforms, voice, video conferencing, payments, remote access and collaboration. In FirstNet's design order, fibre is checked first and LEO is the last resort for a primary link. It is often the best choice as a backup, though, because it does not rely on terrestrial fibre or mobile towers. URL: https://www.firstnet.co.za/knowledge/connectivity/is-leo-as-fast-as-fibre/. Reviewed 2026-10-10. #### Is FirstNet LEO satellite better than a licensed microwave link? For a fixed site with a stable line of sight, an engineered licensed microwave link can outperform LEO. LEO wins in remote regions, difficult terrain, long-distance or temporary deployments, because it needs no tower build or line-of-sight relay and activates faster. How the two compare: - Infrastructure: LEO needs a clear view of the sky at your site; microwave needs line of sight to a high site or tower, confirmed by desktop and physical RF assessment. - Speed to deploy: LEO is generally faster than new terrestrial builds; microwave installation can follow within weeks once line of sight is confirmed. - Performance: LEO offers typical latency of around 50 to 80 ms and speeds up to 100 Mbps download and 20 Mbps upload depending on profile; licensed microwave is carrier-grade, engineered fixed access. - Weather: higher-frequency microwave can be weather-sensitive, and LEO can be affected by severe weather. - Order of preference: for fixed sites without fibre, FirstNet assesses microwave before fixed wireless, LTE/5G and finally LEO. FirstNet assesses both during feasibility and recommends the option that fits your site and resilience goals. At critical sites the two can also be combined, giving two paths that do not share fibre's trench. URL: https://www.firstnet.co.za/knowledge/connectivity/is-leo-satellite-better-than-a-microwave-link/. Reviewed 2026-10-11. #### Is FirstNet Managed Guest Wi-Fi POPIA compliant? Compliance is shared. The Purple platform behind FirstNet Managed Guest Wi-Fi provides consent controls aligned to POPIA and GDPR, but your login method, consent wording, retention and data use determine the outcome. FirstNet helps you set this up correctly. POPIA (the Protection of Personal Information Act) governs how you collect and use guests' personal information, so a platform can enable compliance but cannot guarantee it on your behalf. How responsibilities divide: - Platform: consent-based login and data capture aligned to POPIA and GDPR, ISO 9001 and ISO 27001 certification, annual third-party audits and ongoing vulnerability and penetration testing. - FirstNet: portal and login configuration, hosting region confirmed per deployment through its compliance process, change control and support. - Your organisation: you remain the data controller, approve the terms and privacy wording, and decide on login method, retention and downstream use. Good practice is to keep consent wording clear and specific, collect only the data you need, set a retention period, and keep marketing journeys in the Engage tier opt-in. If you need in-country hosting, a named certification or a completed security questionnaire, raise it early so it can be confirmed before rollout. URL: https://www.firstnet.co.za/knowledge/connectivity/is-the-service-popia-compliant/. Reviewed 2026-10-10. #### Is FirstNet Protected IP Transit the same as multi-homing? No. Protected IP Transit is redundancy engineered into FirstNet's own service design, while multi-homing is your routing strategy across more than one upstream path or provider. They solve different problems and can be used together. The difference in practice: - Protected IP Transit: a FirstNet-engineered redundant service design that adds resilience to the transit FirstNet delivers. FirstNet designs and supports that redundancy. - Multi-homing: you connect to more than one upstream, for example FirstNet plus other providers, and use BGP to control how traffic enters and leaves your network. You design and run that policy. - Connection options: IP Transit supports connecting to FirstNet alone (single-homed) or using FirstNet as one of several upstreams (multi-homed). - Responsibility: FirstNet supports the transit backbone and ports; routing policy, traffic engineering, ASN and IP space compliance remain yours. Many operators combine the approaches, using FirstNet as one of several upstreams for resilience and traffic engineering, and adding Protected IP Transit as traffic grows. It is one of the common upgrade paths on FirstNet IP Transit, alongside more capacity, redundant ports or dual paths, and IPv6 enablement. URL: https://www.firstnet.co.za/knowledge/connectivity/is-protected-ip-transit-the-same-as-multi-homing/. Reviewed 2026-10-10. #### Is FirstNet a licensed internet service provider in South Africa? Yes. FirstNet holds ECS and ECNS licences (for electronic communications services and networks) from ICASA. These licences let FirstNet deploy, manage and resell network services across the country. Licensing goes all the way to the last mile. FirstNet buys access only from fibre, mobile and wireless operators that hold ICASA licences. The wireless ones must also use approved spectrum. FirstNet does not use unlicensed Wi-Fi bridging or grey-market satellite. Its LEO satellite service runs on Eutelsat OneWeb, through partners with ICASA licences. Other credentials and rules it follows: - ISO 27001 for information security, and ISO 9001 for quality. - A B-BBEE Level 1 contributor. - Each router and antenna it installs must be type-approved by ICASA. - It handles RICA registration for each SIM-based service. - It is listed as a Large Member of ISPA, the Internet Service Providers' Association. FirstNet has more than 5,000 business sites under its management. It delivers over 300 new business links each month across South Africa. URL: https://www.firstnet.co.za/knowledge/connectivity/is-firstnet-a-licensed-internet-service-provider-in-south-africa/. Reviewed 2026-10-10. #### Is FirstNet business fibre symmetric and uncapped? FirstNet business fibre is uncapped, and is available as either symmetric (equal upload and download) or asymmetric, depending on the network and product chosen. It is contended (best-effort) by default, but uncontended on local on-net traffic. The terms explained: - Uncapped: no monthly data cap on the service. - Symmetric: upload matches download, which suits video calls, cloud backups and hosted services; asymmetric favours download. - Contended: capacity beyond FirstNet's core is shared, so throughput can vary with wider internet conditions. - On-net: local traffic carried on FirstNet's network, which is uncontended on business fibre. International contention is capped at 1:4, and applies only during undersea cable failures. For mission-critical sites a dedicated, uncontended fibre option can be designed case by case, and premium fibre networks support higher availability targets (up to 99.5%) than standard networks (99%). If you need symmetric, committed bandwidth with 1:1 contention on both local and international traffic, Dedicated Internet Access is the service built for that. FirstNet confirms which fibre networks and profiles are available at your address during feasibility. URL: https://www.firstnet.co.za/knowledge/connectivity/is-firstnet-business-fibre-symmetric-and-uncapped/. Reviewed 2026-10-10. #### Is FirstNet wireless connectivity reliable enough for business use? Yes, when the wireless type fits the site. Licensed microwave is carrier-grade and consistent, fixed wireless depends on coverage and capacity at your address, and LTE/5G is best-effort and varies with network load. In every case FirstNet can add a diverse backup. How the three FirstNet wireless options compare: - Microwave Broadband: licensed point-to-point or point-to-multipoint radio from a high site to your premises. Engineered fixed access, more consistent than mobile broadband, subject to a line-of-sight survey. - Fixed wireless (FWA / Fixed 5G): a packaged, contended fixed-site service, usually with an availability target of up to about 99% and next-business-day fault restoration as standard. - LTE/5G: carrier-agnostic mobile broadband on the strongest network at your site, best-effort with no fixed uptime SLA. Reliability also comes from the groundwork. Every wireless option is validated for your exact address before installation, because trees, buildings, terrain and rooftop access affect delivery. Services run only through ICASA-licensed operators on approved spectrum, with ICASA type-approved routers and antennas and no unlicensed Wi-Fi bridging. Wireless also has a resilience advantage: it does not share fibre's trench, which makes it a strong backup for a fibre primary. URL: https://www.firstnet.co.za/knowledge/connectivity/is-wireless-reliable-enough-for-business/. Reviewed 2026-10-11. #### Is FirstNet's LEO satellite service licensed in South Africa? Yes. FirstNet's LEO satellite service runs on Eutelsat OneWeb and reaches South African sites through partners licensed by ICASA, so it is compliant for use here. FirstNet itself holds ICASA licences for ECS and ECNS. It is ISO 27001 certified and a B-BBEE Level 1 contributor. Licensing matters because business connectivity should run on services that may legally operate in the country. FirstNet takes the same line on all its wireless and satellite services. It delivers them only through ICASA-licensed operators, with ICASA type-approved equipment. It does not use grey-market satellite. What you get, with FirstNet as your one accountable provider: - Licensed business LEO on Eutelsat OneWeb. - Managed installation, monitoring and support. - Coverage and licence checks for each site before quoting. - Integration with fibre, LTE/5G, SD-WAN and security. - Service in South Africa and across Africa. FirstNet is also ISO 9001 certified for quality. When you ask for a quote, FirstNet checks coverage and licensing for your site. It usually replies within one business day. URL: https://www.firstnet.co.za/knowledge/connectivity/is-firstnets-leo-satellite-service-licensed-in-south-africa/. Reviewed 2026-10-10. #### Is managed guest Wi-Fi included with FirstNet business internet? Yes. The Connect tier of FirstNet Managed Guest Wi-Fi is delivered with FirstNet internet links: a branded captive portal, flexible login options, multi-site management and consent-based capture, all operated by FirstNet. Guest Intelligence (Capture) and Guest Engagement (Engage) are optional add-ons. What Connect gives you: - A branded captive portal per brand or venue - Login by email, mobile, social, or OTP via SMS or WhatsApp - Multi-site management - Consent-based capture aligned to POPIA and GDPR - Guest access on a dedicated SSID or VLAN, separate from business systems Add Capture when you want visitor analytics such as recency, frequency, dwell time and repeat visits, with dashboards and scheduled reports. Add Engage for opt-in journeys, segmentation, automated campaigns and CRM or loyalty integrations. Tiers can be mixed by venue. What is not included: new access points, cabling, LAN upgrades or full Wi-Fi redesigns, which are only included if separately scoped. The service works as an overlay on your existing Wi-Fi, so you provide access to your controller settings, a guest SSID or VLAN, and your branding assets. URL: https://www.firstnet.co.za/knowledge/connectivity/is-managed-guest-wi-fi-included-with-firstnet-internet/. Reviewed 2026-10-10. #### Is speed guaranteed on FirstNet business fibre broadband? No. Standard FirstNet business fibre is best-effort beyond FirstNet's core network, so throughput can vary with wider internet conditions, and a web-based speed test on its own is not treated as proof of under-performance. If your site needs committed bandwidth, the right service is Dedicated Internet Access (DIA) or a dedicated fibre variant. Best-effort does not mean unmanaged. Standard business fibre is: - Uncontended on local (on-net) traffic - Subject to international contention of at most 1:4, and only during undersea cable failures - Carried across seven or more undersea cable systems with automatic rerouting - Monitored through a FirstNet-managed router on PRTG, including bandwidth Speed tests are only a rough guide, because the result also depends on the test server, the route to it and the device running it, not just on your link. DIA is the step up when performance must be enforceable. It gives dedicated 1:1 contention on local and international traffic, symmetric committed bandwidth that does not degrade at peak, and defined SLAs with service credits. A dedicated fibre variant can also be designed case by case for mission-critical sites. URL: https://www.firstnet.co.za/knowledge/connectivity/is-speed-guaranteed-on-business-fibre-broadband/. Reviewed 2026-10-10. #### Is there an uptime SLA on FirstNet LTE/5G business internet? No. LTE/5G mobile broadband is a best-effort service without a fixed uptime SLA, because performance varies with mobile network load and signal. FirstNet still supplies a business-grade managed router, optimises signal and monitors the link. Where LTE/5G is the right tool: - Rapid go-live, often within a few working days - Temporary sites, pop-ups, construction sites, vehicles and portable units - Failover for fibre, since it is not affected by fibre cuts or cable theft Where it is not the best primary: if a fixed site needs a link with service levels, fibre or licensed microwave is preferred where feasible. Business fibre carries availability targets up to 99.5% on premium networks and 99% on standard, and fixed wireless usually targets up to about 99%. Temporary wireless used while fibre is built also carries no SLA and runs on a minimum six-month term. If you depend on LTE/5G at a remote site, design can reduce the risk: pair it with LEO satellite, which is independent of mobile towers, or bond several links with Peplink so a single network problem does not take the site offline. URL: https://www.firstnet.co.za/knowledge/connectivity/is-there-an-uptime-sla-on-lte-5g-business-internet/. Reviewed 2026-10-10. #### Should FirstNet LEO satellite replace our fibre connection? No. Where viable fibre exists, it remains the better primary for speed, latency and consistency. LEO is the right answer where fibre is absent, slow or unreliable, or where you need a genuinely independent backup path. How FirstNet positions LEO: - Off-grid primary: LEO as the sole connection where fibre is absent, unreliable or has prohibitive lead times. - Hybrid failover: fibre primary with LEO as a critical backup on infrastructure that does not share fibre's failure modes. - SD-WAN path diversity: LEO as a diverse underlay alongside fibre or LTE, with per-site failover orchestrated by SD-WAN. - Temporary and rapid deployment: construction sites, project offices, events and new locations connected while permanent infrastructure is built. The case for LEO as a backup is strong because it does not rely on terrestrial fibre or mobile towers. That reduces the risk of your primary and backup failing together from the same fibre cut, infrastructure failure or local outage. In FirstNet's technology order, fibre comes first, then licensed microwave, fixed wireless and LTE/5G, with LEO satellite as the last resort for a primary link. FirstNet assesses the options for each site during feasibility. URL: https://www.firstnet.co.za/knowledge/connectivity/should-leo-replace-our-fibre/. Reviewed 2026-10-10. #### Should we choose FirstNet SD-WAN or Peplink bonding? Choose SD-WAN for application-aware, policy-based control across many sites, with QoS and security policy. Choose Peplink SpeedFusion bonding when a single live call or RDP session must survive a link cut without dropping, because it bonds links at packet level. How to choose: - SD-WAN: policy-driven control across many sites, application-aware steering, QoS and integrated security, including phased migration away from MPLS. - Peplink bonding: when live sessions such as voice, video or RDP must not drop, because sub-second hot failover keeps active TCP and UDP sessions running. - Peplink for rugged and mobile use: vehicles, broadcast, mining and pop-up sites, using MAX series hardware and bonded cellular modems. - Peplink for noisy links: Forward Error Correction and WAN Smoothing protect real-time traffic. Both need at least two links per site, and FirstNet can supply the underlays for either: fibre, DIA, LTE/5G, microwave and LEO satellite. Peplink is itself an SD-WAN edge; the difference is that most SD-WAN keeps each session on one link, while SpeedFusion splits a single flow across links. FirstNet can recommend the right approach after a site survey. URL: https://www.firstnet.co.za/knowledge/connectivity/should-we-choose-sd-wan-or-peplink-bonding/. Reviewed 2026-10-11. #### Should we use FirstNet LEO satellite or LTE/5G for a remote or backup link? LEO is independent of mobile towers, more predictable where cellular coverage is rural or unstable, and better suited to mission-critical uptime, while LTE/5G can be lower cost for light use or urban failover where coverage is strong. Many critical sites use both alongside fibre, with SD-WAN steering traffic between them. How to decide: - Coverage: LTE/5G needs usable signal from a mobile network; LEO needs a clear view of the sky. - Independence: LEO does not rely on terrestrial fibre or mobile towers; LTE/5G is unaffected by fibre cuts but can be affected by tower power outages. - Consistency: LEO gives a consistent service profile across ATMs, point-of-sale sites, clinics and branches; LTE/5G is best-effort and varies with network load. - Speed to deploy: LTE/5G is often live within a few working days; LEO is generally faster than a new fibre build. - Service levels: LTE/5G has no fixed uptime SLA. For remote sites with rural or unstable cellular coverage, LEO is usually the more dependable choice. For urban branches with strong signal, LTE/5G is a cost-effective fibre backup. Where both are available, bonding them with Peplink or steering them with SD-WAN adds a further layer of resilience. URL: https://www.firstnet.co.za/knowledge/connectivity/should-we-use-leo-satellite-or-lte-5g-for-a-remote-or-backup-link/. Reviewed 2026-10-10. #### Should we use Peplink FusionHub or SpeedFusion Cloud for bonded tunnels? Use FusionHub when bonded tunnels should end inside your own data centre or cloud (VMware, Hyper-V, AWS, Azure or GCP). Use SpeedFusion Cloud, on Peplink-hosted points of presence, for vehicles and rural sites. Mixed designs are common. Bonding needs a far end: the links bonded at each site are reassembled into one connection at a termination point before traffic continues to the internet or your network. The options: - FusionHub: you host it, so bonded traffic arrives inside your own environment, for example in a data centre or public cloud close to your applications. - SpeedFusion Cloud: Peplink hosts it, so no fixed central site is needed, which suits vehicles, mobile units and rural sites. - EPX: Peplink's enterprise core router for head office or data centre hubs that aggregate many branches. FirstNet designs tunnel termination as part of its structured rollout, after the site survey, link selection, hardware sizing and InControl 2 onboarding. A mixed design might use FusionHub for fixed branches and SpeedFusion Cloud for vehicles. FirstNet then runs the estate through InControl 2 and its NOC. URL: https://www.firstnet.co.za/knowledge/connectivity/fusionhub-or-speedfusion-cloud/. Reviewed 2026-10-11. #### We already have guest Wi-Fi. Why move to FirstNet Managed Guest Wi-Fi? A managed service adds an operating model on top of your existing Wi-Fi rather than replacing it. FirstNet handles portal changes, consent governance and multi-site consistency, so branding and terms stay aligned across all venues and support runs through one provider. What changes when it is managed: - Consistency: portals per brand or venue from a standard template, with approved variations and change control. - Governance: consent-based login aligned to POPIA and GDPR, with you as data controller and FirstNet helping set up wording and retention correctly. - Security: guest access on a dedicated SSID or VLAN, separate from business systems, with optional Purple Shield content filtering. - Insight: a path to visitor analytics (Capture) and opt-in engagement (Engage) when the business is ready. - Support: one provider for set-up, changes and ongoing support. It works with your existing access points as a hardware-agnostic overlay, so there is no forced equipment swap. Rollout is phased: discovery, a pilot at one to four sites, then wider rollout by brand or region readiness. If you already provide free Wi-Fi, a branded login turns it into a source of consented customer insight: visit patterns, dwell time and, with the optional Purple Surveys add-on, real-time guest feedback. URL: https://www.firstnet.co.za/knowledge/connectivity/we-already-have-guest-wi-fi-why-move-to-a-managed-service/. Reviewed 2026-10-10. #### What SLAs does FirstNet offer on business broadband and last-mile connectivity? FirstNet offers enterprise service levels covering availability, response times and restoration targets. On broadband links, availability targets and service credits follow the underlying last-mile provider's SLA, and FirstNet handles escalation, SLA validation and credit claims for you. What applies depends on the access type: - Business fibre: availability targets up to 99.5% on premium networks and 99% on standard, with a service-credit schedule. - Dedicated Internet Access: defined SLAs with service credits aligned to the carrier's commitments, set out in your contract, on uncontended, symmetric bandwidth engineered for predictable latency, jitter and packet loss. - Fixed wireless: usually an availability target of up to about 99%, with next-business-day fault restoration as standard. - LTE/5G: best-effort, with no fixed uptime SLA. Temporary wireless, used while fibre is built, also carries no SLA and runs on a minimum six-month term. Your exact targets are set out in your contracted service terms. How a credit claim works in practice: - The fault is picked up by monitoring or logged by you with FirstNet support. - FirstNet's NOC works the fault with the carrier through to restoration. - FirstNet validates the outage against the carrier's SLA. - FirstNet submits the claim and passes the credit through once the carrier pays it. You do not chase the fibre or wireless operator yourself, because FirstNet is the single escalation point across all underlying providers. For multi-site customers FirstNet works to standardised SLAs across its national footprint, with one escalation point, and monitored links come with alerts and monthly service reviews. Support and monitoring run on different clocks. Standard broadband support runs during business hours with after-hours callout for severity 1 issues, and the exact cover depends on your service tier. Monitoring does not stop after hours: every managed router is on FirstNet's PRTG platform with SNMP up/down and bandwidth alerting, and the NOC handles incident response. Tickets go to support@firstnet.co.za or the support portal, and escalations run through your Service Manager. When comparing providers, look at two numbers. The SLA is the promise on uptime, response and restoration. MTTR (mean time to restore) is how long outages actually last. A link can meet its SLA on paper and still hurt the business if each fault takes long to fix, because a fibre cut needs physical repair and a microwave link may need realignment or site access. Service credits compensate for downtime but do not prevent it. For revenue-impacting sites, FirstNet's default design is a primary link plus a diverse backup, such as licensed microwave, LTE/5G, a second fibre on another carrier or LEO satellite, so traffic fails over while the primary fault is worked. If a site has outgrown best-effort broadband, Dedicated Internet Access gives committed bandwidth with defined, carrier-aligned SLAs. URL: https://www.firstnet.co.za/knowledge/connectivity/what-slas-are-available/. Reviewed 2026-10-11. #### What are our options if we can't wait months for fibre at a new business site? For a fixed site, FirstNet checks licensed microwave first, then fixed wireless; if you need to be live in days, FirstNet deploys LTE/5G immediately and builds the fibre primary in parallel. Temporary wireless runs on a minimum six-month term without an SLA. Fibre lead times are typically several weeks to months, depending on construction, wayleaves and landlord approvals, and the clock starts once approvals are in place. The alternatives move faster: - LTE/5G: often live within a few working days, using a RICA-registered SIM in a pre-configured, FirstNet-managed router. - Licensed microwave: subject to a line-of-sight survey; installation can follow within weeks once line of sight is confirmed. - Fixed wireless: timing depends on coverage and capacity at your address. - LEO satellite: generally faster to deploy than a new fibre build, for remote or hard-to-reach sites. FirstNet calls this pattern temporary wireless first: the site opens on time on LTE/5G, and when the fibre goes live it becomes the primary link. Temporary wireless is subject to coverage and landlord approval. Once the fibre is in, the wireless service can be retained as a backup if you choose, giving the site a diverse failover path. URL: https://www.firstnet.co.za/knowledge/connectivity/we-cant-wait-months-for-fibre-what-are-our-options/. Reviewed 2026-10-10. #### What business outcomes should business internet connectivity be measured on? Business internet should be judged on business outcomes, not on circuits or carriers. FirstNet designs its connectivity against four: uptime, steady latency, lower risk and simpler operations. - Uptime: built through engineered resilience and multi-carrier design, not best effort. - Steady latency: direct peering and uncongested paths, so cloud and voice workloads feel close to a local network. - Lower risk: true diversity of carriers, media and routes, so one outage rarely becomes a business incident. - Simpler operations: one vendor and one accountable team, so IT spends less time juggling providers. Uptime on its own is not enough. Latency, jitter and packet loss directly affect how applications perform. Real-time tools such as voice and video calls are especially sensitive to them. That is why FirstNet monitors these measures and link usage around the clock, not just whether a line is up. These measures translate into business terms: transaction speed, system uptime, customer experience and productivity. When you weigh cost, compare it with the cost of downtime. That includes lost opportunity, recovery effort and damage to your reputation, not just the price of access. URL: https://www.firstnet.co.za/knowledge/connectivity/what-business-outcomes-should-business-connectivity-be-measured-on/. Reviewed 2026-10-10. #### What contract terms are available for FirstNet business fibre? FirstNet business fibre is a fixed-term monthly service, typically over 12, 24 or 36 months, with a notice period of three calendar months. Upgrades need one month's written notice and extend the term by at least 12 months. What this means in practice: - Term: a fixed term, typically 12, 24 or 36 months, billed monthly. - Notice: three calendar months. - Upgrades: one month's written notice, and the upgrade extends the term by at least 12 months. - Equipment and addressing: the managed router and allocated public IP addresses remain FirstNet property. Other connectivity services have their own terms. Temporary LTE/5G wireless, used while fibre is being built, runs on a minimum six-month term without an SLA. LEO satellite event connectivity is installed the day before an event and removed the day after, with no contractual commitment. IP Transit is usually sold on longer-term agreements, with the term confirmed during commercial engagement. Your exact term, notice period and service levels are set out in your signed service schedule, which FirstNet confirms at order intake before provisioning starts. URL: https://www.firstnet.co.za/knowledge/connectivity/what-contract-terms-are-available/. Reviewed 2026-10-10. #### What do we need to provide at our site for a FirstNet connectivity installation? You provide power, mast space, ducting and similar facilities at the installation point, and obtain third-party approvals such as landlord, body corporate or municipal consent. You also give site access during agreed install windows and supply RICA documentation for SIM-based services. The full site-readiness list: - Power, mast space and ducting at the installation point - Landlord, body corporate or municipal consent for installation - Site access during agreed install windows - Notice of safety requirements such as PPE, inductions or restricted hours - RICA documentation for SIM-based services - Ownership of your LAN and firewall configuration, unless separately scoped Approvals are often the longest part of a fibre lead time. FirstNet coordinates landlord, wayleave and municipal approvals with the carrier, and the installation clock starts once they are in place. Microwave and fixed wireless sites also get a site survey, because line of sight, rooftop access and mounting positions affect delivery. After installation, FirstNet sends a Service Handover Form within two business days, and you have two business days to test before the link moves to the NOC for monitoring. URL: https://www.firstnet.co.za/knowledge/connectivity/what-do-we-need-to-provide-at-our-site-for-a-connectivity-installation/. Reviewed 2026-10-10. #### What does carrier-neutral business connectivity mean, and is FirstNet carrier-neutral? Carrier-neutral means your connectivity is not tied to one network operator or one technology. FirstNet is carrier-neutral: its reach spans every major fibre network operator and mobile network operator in South Africa, and each site gets the best available combination of fibre, microwave, fixed wireless, LTE/5G and LEO satellite. The choice at each site is made on coverage, performance and resilience, not on which network a provider happens to own. For fibre, FirstNet works with major ICASA-licensed fibre network operators such as Vumatel, Frogfoot, Openserve and MetroFibre, procuring Layer 2 access circuits and running its own internet service over them from the FirstNet core. For LTE/5G it selects the mobile network with the best signal and service quality at each site. What this means for you: - Primary and backup links can sit on different carriers and media, so a single network outage does not become your outage. - Coastal, rural and industrial sites can be served within one design. - You still get one contract, one unified SLA and one 24/7 NOC number across every site. Neutrality does not mean shortcuts: every last mile FirstNet uses comes from ICASA-licensed operators on approved spectrum. URL: https://www.firstnet.co.za/knowledge/connectivity/what-does-carrier-neutral-business-connectivity-mean/. Reviewed 2026-10-10. #### What happens during a FirstNet LEO satellite installation? FirstNet confirms site readiness, books an install slot, then installs the antenna, activates the service and enables monitoring. Finally, FirstNet confirms your support contacts, ticket channels and escalation path. Site readiness is validated before installation so there are no surprises on the day. Your site needs: - A clear view of the sky, usually a roof or open area - A secure mounting position on the building or site - Power where the equipment will be installed - Site access for installation, including permits or safety inductions - Accurate GPS coordinates that plot to the installation roof Obstructions are checked at this stage, because dense tree canopy or structures in the antenna's field of view can affect performance. Once installed, the service is managed by FirstNet, with proactive monitoring, service management and coordinated support across technologies and providers. If LEO is part of a wider design, FirstNet integrates it with your fibre, LTE/5G, SD-WAN and firewalls. To start, FirstNet checks coverage and licensing for your location and usually comes back with a quote within one business day. URL: https://www.firstnet.co.za/knowledge/connectivity/what-happens-during-installation/. Reviewed 2026-10-10. #### What happens if a Peplink router supplied by FirstNet fails? FirstNet coordinates the hardware warranty and swap-out process on your behalf, including Peplink advanced replacement where your support bundle provides it. As a Peplink Certified Engineer (PCE) partner, FirstNet can also escalate complex platform issues directly to Peplink engineering. How a hardware fault is handled: - Detection: InControl 2 alerts feed the FirstNet NOC, so a failed or offline device is picked up. - Ticketing: faults are logged and managed through one FirstNet support desk. - Replacement: FirstNet coordinates warranty and swap-out, using Peplink advanced replacement where your bundle includes it. - Escalation: complex platform issues go directly to Peplink engineering through FirstNet's PCE partnership. FirstNet has multi-year Peplink deployment experience across South African enterprise, retail, mining and mobile fleets, and runs InControl 2 cloud management on your behalf, which keeps device configuration and firmware under central control. For sites where even a short hardware outage is unacceptable, raise it during design. Hardware is sized per site by throughput, ports, cellular modems and environment, and power and UPS sizing is part of the site survey. URL: https://www.firstnet.co.za/knowledge/connectivity/what-happens-if-a-peplink-router-fails/. Reviewed 2026-10-10. #### What happens to FirstNet Dedicated Internet Access when an undersea cable fails? FirstNet DIA routes international traffic across seven undersea cable systems and multiple global peering hubs, so traffic is automatically engineered around a failed or congested route. If a cable is cut, traffic reroutes without you needing to act. International performance depends on where traffic leaves South Africa and how it is routed. For DIA, FirstNet builds that diversity in: - Capacity across seven undersea cable systems, including WACS, EASSy, SEACOM and 2Africa - Peering at global hubs including London, New York, Brazil, Germany, Marseilles and Singapore - Automatic rerouting over alternate paths when a cable is interrupted or a region is congested - Dedicated 1:1 contention specified on international as well as local traffic This is one of the clearest differences from standard business fibre, where international contention is limited to a maximum of 1:4, and only during undersea cable failures. Local traffic is less exposed to cable faults in the first place. FirstNet peers directly at NAPAfrica, JINX, CINX and DINX, so traffic to South African services, banks and platforms stays in the country rather than travelling offshore and back. URL: https://www.firstnet.co.za/knowledge/connectivity/what-happens-when-an-undersea-cable-fails/. Reviewed 2026-10-10. #### What happens to FirstNet internet traffic when an undersea cable is cut? FirstNet reroutes the traffic automatically over other paths. It has capacity on seven or more undersea cable systems, such as WACS, EASSy, SEACOM and 2Africa. Cable breaks are a repeat risk for South Africa's international links, because that traffic relies on only a few subsea systems. How FirstNet reduces the risk: - Cable diversity: capacity on seven or more systems, so one break does not cut off international reach. - Automatic rerouting: if a cable is cut or a region is congested, traffic moves to other paths. - Multi-peer transit at global hubs such as LINX London, New York, Frankfurt and Singapore. - Contention limits: on business fibre, international contention is capped at 1:4 at most, and only during undersea cable failures. Local traffic is protected in a different way. FirstNet peers directly at NAPAfrica, JINX, CINX and DINX. So traffic to South African services stays in the country and does not rely on international routes. FirstNet was also the first client on the 2Africa cable's Durban to Cape Town segment. This subsea route avoids fibre cuts and vandalism on land. Where international performance is critical, Dedicated Internet Access (DIA) adds dedicated 1:1 contention on international traffic. URL: https://www.firstnet.co.za/knowledge/connectivity/what-happens-when-an-undersea-cable-is-cut/. Reviewed 2026-10-10. #### What infrastructure is FirstNet Dedicated Internet Access delivered over? FirstNet Dedicated Internet Access (DIA) runs over approved fibre from operators licensed by ICASA, in line with ECS and ECNS rules. It is a Layer 3 service into the FirstNet core, and it may not run over unlicensed access technology. The layers that make up the service: - Access: approved fibre from ICASA-licensed operators, if a carrier can serve your site. - Service: a Layer 3 link into the FirstNet core, with static public IP addresses and enterprise routing. - Core network: FirstNet's own Autonomous System, with diverse upstream providers. It peers directly at NAPAfrica, JINX, CINX and DINX. - International: peering at global hubs such as London, New York, Brazil, Germany, Marseilles and Singapore. Traffic crosses seven undersea cable systems, with automatic rerouting. Contention is a dedicated 1:1 on local and international traffic. Bandwidth is symmetric (the same speed up and down) and committed. Delivery depends on whether a carrier can serve your address. FirstNet confirms this before provisioning, installation and handover to support. Because DIA runs over fibre, a site that fibre cannot reach needs a different primary link, such as licensed microwave. FirstNet can design that site as part of the same estate. URL: https://www.firstnet.co.za/knowledge/connectivity/what-infrastructure-is-dedicated-internet-access-delivered-over/. Reviewed 2026-10-10. #### What is SD-WAN and how does FirstNet use it for business networks? SD-WAN (software-defined wide area networking) is an overlay that manages multiple network links across your sites, routing traffic based on application requirements, link performance and business policy. FirstNet SD-WAN is a centrally managed, policy-driven service that keeps business-critical applications predictable even when one link degrades or fails. What FirstNet SD-WAN provides: - Dynamic path selection and failover across multiple links - Load balancing and application-aware traffic steering - Quality of Service for business-critical applications - Integrated security policy enforcement - Centralised visibility and governance across all sites SD-WAN controls how traffic uses your links; it does not make a poor last mile faster or remove contention. It therefore needs at least two links per site, and FirstNet's best practice is two diverse underlays, often one fibre and one wireless. FirstNet can supply those underlays itself (broadband, DIA, LTE/5G, microwave and LEO satellite), and hybrid designs let MPLS and internet links run side by side for a phased migration. It suits retail and branch networks where uptime drives revenue, municipalities that need standardised behaviour across many sites, and cloud-heavy enterprises. FirstNet's Connectivity and Security teams validate each design together before rollout. URL: https://www.firstnet.co.za/knowledge/connectivity/what-is-sd-wan/. Reviewed 2026-10-10. #### What is included with a FirstNet business broadband link? A standard FirstNet business fibre service includes the fibre circuit, a FirstNet-managed router, a static public IP address and a PRTG monitoring sensor, so the link is watched for up/down status and bandwidth from day one. Microwave services include the licensed radio link, an indoor router and PRTG monitoring. The fibre service in more detail: - Symmetric or asymmetric, uncapped business fibre - Uncontended on local (on-net) traffic, with international contention capped at 1:4 and only during undersea cable failures - Up to two static public IPs by default: one on the router and one for your own use - NOC incident response, with FirstNet liaising with the carrier on your behalf - Availability targets up to 99.5% on premium networks and 99% on standard Optional extras include additional static IPs, a dedicated (uncontended) fibre variant and a second fibre link on an alternate carrier. Delivery follows a set path: order intake, feasibility validation, provisioning, install and test, then a Service Handover Form, after which the NOC monitors the link. Standard support runs during business hours, with after-hours callout for severity 1 issues. URL: https://www.firstnet.co.za/knowledge/connectivity/what-is-included-with-a-firstnet-business-broadband-link/. Reviewed 2026-10-10. #### What is last-mile connectivity? Last-mile connectivity is the final link from a provider's network to your premises, carried over fibre, radio or satellite. It largely decides the speed, reliability and lead time your site gets. It is the hardest part of a connection to deliver, because it has to be built or engineered to each address. Fibre may need construction, wayleaves and landlord approvals, so lead times typically run from several weeks to months. LTE/5G can often be live within a few working days. FirstNet's last-mile options: - Business fibre on the major open-access networks, with availability targets up to 99.5% on premium networks and 99% on standard - Dedicated Internet Access: uncontended, symmetrical internet for head offices and critical sites - Licensed microwave, subject to a line-of-sight survey - Fixed wireless and LTE/5G where fibre is not yet available, or as a backup link - LEO satellite for remote sites, with typical latency of around 50 to 80 ms FirstNet is carrier- and medium-agnostic, so it picks the access type per site after a site survey. For a fixed site without fibre, it checks licensed microwave first, then fixed wireless, LTE/5G and finally LEO. Where options are limited, it designs blended connectivity to meet performance and availability targets, and for critical sites it adds a diverse backup path. FirstNet's Nationwide Last-Mile Connectivity service puts every site under one provider: a FirstNet-managed router on each link, PRTG monitoring with alerts, NOC incident response and one escalation point across all underlying carriers. On broadband, service levels follow the last-mile provider's SLA, and FirstNet handles escalation and credit claims on your behalf. URL: https://www.firstnet.co.za/knowledge/connectivity/what-is-last-mile-connectivity/. Reviewed 2026-10-11. #### What is the difference between FirstNet IP Transit and Dedicated Internet Access (DIA)? DIA is a managed enterprise internet service for offices and core sites. IP Transit is a wholesale service for organisations that run their own network and want full control of routing using BGP. The deciding question is who runs the routing. With DIA, FirstNet does: you receive a fully managed Layer 3 internet service with static public IPs, enterprise routing, dedicated 1:1 contention and symmetric committed bandwidth, delivered over approved fibre. With IP Transit, you do: your Autonomous System gets access to the global routing table through FirstNet's upstream and peering ecosystem, and you set routing policy and traffic engineering yourself. IP Transit fits if you: - Hold a public ASN and run a router with BGP v4 - Are an ISP or WISP, a hosting, cloud or data centre operator, a CDN, or an enterprise with in-house network engineering - Want to multi-home across several upstreams - Need uncontended, capacity-based transit Choose DIA if you want FirstNet to manage the service end to end for a head office, data centre or other critical site. The support boundaries differ too: IP Transit support covers FirstNet's transit domain, backbone and ports, while your routing policy remains your responsibility. URL: https://www.firstnet.co.za/knowledge/connectivity/what-is-the-difference-between-ip-transit-and-dia/. Reviewed 2026-10-10. #### What is the difference between an SLA and MTTR for business connectivity? An SLA (Service Level Agreement) is the service commitment, such as uptime, response time and resolution targets, while MTTR (Mean Time to Repair or Restore) is the average time it actually takes to restore service after a fault. The SLA is the promise; MTTR shows how quickly recovery happens in practice. The two work together. An availability target says how much downtime is acceptable over a period, while MTTR shows how long each outage tends to last. A service can meet its SLA on paper and still hurt the business if individual faults take long to restore. How this applies to FirstNet connectivity: - Broadband availability targets and service credits follow the underlying last-mile provider's SLA, and FirstNet handles escalation, SLA validation and the credit claim on your behalf. - FirstNet business fibre carries availability targets up to 99.5% on premium networks and 99% on standard. - LTE/5G is best-effort, with no fixed uptime SLA. - FirstNet acts as the single escalation point across all underlying providers, which is aimed at faster fault resolution and a better MTTR. Because a fibre cut needs physical repair, the most effective way to cut real downtime is a diverse backup link that carries traffic while the primary is restored. URL: https://www.firstnet.co.za/knowledge/connectivity/whats-the-difference-between-an-sla-and-mttr/. Reviewed 2026-10-10. #### What is the difference between licensed microwave and fixed wireless (FWA) from FirstNet? Microwave Broadband is a licensed point-to-point or point-to-multipoint radio link from a tower or high site to your premises. Fixed wireless (FWA / Fixed 5G) is a packaged, contended service delivered over fixed 5G or approved partner platforms. The practical differences: - Engineering: microwave is built for your site after a desktop and physical line-of-sight and RF assessment; fixed wireless is a packaged service that depends on coverage and capacity at your address. - Consistency: microwave is carrier-grade and more consistent than mobile broadband; fixed wireless is contended and best-effort. - Speeds: fixed wireless is typically asymmetric and uncapped, from about 5 to 10 Mbps up to 100 Mbps or more, depending on technology and distance. - Service levels: fixed wireless usually carries an availability target of up to about 99%, with next-business-day fault restoration. - Equipment: microwave uses an outdoor radio or antenna on a roof, wall or mast plus an indoor router; fixed wireless uses an indoor or outdoor unit confirmed during feasibility. Where a fixed site has no fibre, FirstNet assesses microwave first, then fixed wireless, then LTE/5G. Microwave is also a strong fibre backup because it does not share fibre's trench. URL: https://www.firstnet.co.za/knowledge/connectivity/whats-the-difference-between-microwave-and-fixed-wireless/. Reviewed 2026-10-10. #### What network visibility and reporting does FirstNet provide on its ISP services? FirstNet gives you dashboards and reports that show uptime, usage, latency and incident history for your internet services. Monitored links also come with alerts and monthly service reviews. This view runs on FirstNet's monitoring tools and its 24/7 Network Operations Centre (NOC): - Telemetry, alerts and live dashboards across the backbone and managed links. - PRTG link monitoring, with SNMP up/down alerts and bandwidth tracking on every managed router. - Performance measures such as latency, packet loss, jitter and link usage, not just line status. - Incident history, so repeat faults and trends are easy to see. - Published performance metrics and regular reviews to keep service quality up. The aim is open, clear performance data. You see how your links are performing and why, instead of only hearing about it when something breaks. That view also helps planning. For example, you can schedule a capacity upgrade before usage becomes a constraint. For multi-site estates, FirstNet SD-WAN adds a central view across all sites. Managed Peplink setups add per-link visibility through InControl 2. Service management follows ITIL-aligned incident, problem and change processes, with clear SLAs and escalation paths. URL: https://www.firstnet.co.za/knowledge/connectivity/what-visibility-do-we-get/. Reviewed 2026-10-10. #### What support hours apply to FirstNet business broadband? Standard FirstNet broadband support runs during business hours, with after-hours callout for severity 1 issues. The exact cover depends on your service tier and is set out in your contracted service terms. Monitoring does not stop after hours. Every managed router is on FirstNet's PRTG platform with up/down and bandwidth alerting, FirstNet monitors business connectivity environments on a 24x7 basis, and the NOC handles incident response and liaises with the underlying carrier on your behalf. How to get help: - Log a ticket at support@firstnet.co.za or through the support portal. - Severity 1 issues qualify for after-hours callout. - Escalations run through your Service Manager. - FirstNet coordinates the carrier, so you do not need to contact the fibre or wireless operator yourself. If a site cannot afford to wait for a repair outside business hours, the best protection is a diverse backup link. When the primary fails, traffic moves to the second link while the fault is worked, which is why FirstNet treats primary plus diverse backup as its default design for revenue-impacting sites. URL: https://www.firstnet.co.za/knowledge/connectivity/what-support-hours-apply-to-business-broadband/. Reviewed 2026-10-10. #### What type of internet connectivity is best for a South African business? There is no single best option: the right connectivity depends on your performance requirements, the applications you run and how much downtime the business can tolerate. For most fixed sites FirstNet starts with business fibre as the primary link and adds a diverse backup where downtime costs revenue. Each technology solves a different problem: - Business fibre: the primary medium for most businesses, with high speeds, low latency and stable performance. - Dedicated Internet Access (DIA): uncontended, symmetric, committed bandwidth for head offices, core sites and hubs. - Licensed microwave and fixed wireless: fixed-site access where fibre is not feasible, or a backup that does not share fibre's trench. - LTE/5G: rapid go-live, temporary sites and failover, often live within a few working days. - LEO satellite: remote sites where no terrestrial option fits, or an independent backup path. FirstNet starts the design with one question: what happens if your internet is down for two hours, or a full day? Non-critical sites may accept a single link, revenue-impacting sites get a primary plus a diverse backup, and multi-site estates often add SD-WAN across two links per site. Cost is then weighed against business risk rather than access price alone. A FirstNet specialist can assess your sites and recommend the mix. URL: https://www.firstnet.co.za/knowledge/connectivity/what-connectivity-is-best-for-business/. Reviewed 2026-10-10. #### When does a business need FirstNet Dedicated Internet Access instead of broadband? Dedicated Internet Access (DIA) makes sense when best-effort broadband is no longer enough. Common signs are application or transaction failures on broadband, audit or regulatory requirements for enforceable performance, a move to international cloud platforms, or a redesign of core sites where stable international routing matters more than headline speed. Signals that point to DIA: - Transactions, voice or business applications fail or degrade on broadband - Auditors or regulators require enforceable performance and accountability - Workloads are moving to international cloud platforms - A head office, data centre or SD-WAN hub is being redesigned - The organisation operates in financial services, government or healthcare What DIA gives you: dedicated 1:1 contention on local and international traffic, symmetric committed bandwidth that does not degrade at peak, predictable latency, jitter and packet loss, static public IPs, and defined SLAs with service credits aligned to the carrier. DIA is not intended for price-only branch access or guest Wi-Fi, where business broadband is the better fit. Many estates use both: DIA at core sites and broadband at branches, with broadband also serving as a cost-effective backup to DIA. URL: https://www.firstnet.co.za/knowledge/connectivity/when-does-a-business-need-dedicated-internet-access-instead-of-broadband/. Reviewed 2026-10-10. #### Where is guest data from FirstNet Managed Guest Wi-Fi hosted? Hosting region options are confirmed for each deployment and documented through FirstNet's security and compliance process. The Purple platform hosts data within defined geographic regions and is ISO 9001 and ISO 27001 certified. Because the region is set per deployment rather than fixed, raise your requirements early. Points to confirm before rollout: - Whether your organisation requires in-country (South African) hosting - Any named certification your policies require - Whether a security questionnaire must be completed - Your retention period for guest data - Which integrations, such as CRM or loyalty platforms, will receive the data Platform assurance includes ISO 9001 and ISO 27001 certification, annual third-party audits, and ongoing vulnerability and penetration testing. Guest data is captured through consent-based login aligned to POPIA and GDPR, and your organisation remains the data controller for its guest dataset. Hosting location matters because POPIA sets conditions for transferring personal information outside South Africa. Confirming the region at the discovery stage, before the pilot at one to four sites, avoids rework later. URL: https://www.firstnet.co.za/knowledge/connectivity/where-is-guest-wi-fi-data-hosted/. Reviewed 2026-10-10. #### Which cloud platforms does FirstNet peer with directly? FirstNet runs direct private peering with Microsoft Azure and Microsoft 365, Amazon Web Services (AWS), Google Cloud and major content delivery networks (CDNs), and peers locally at the NAPAfrica, JINX, CINX and DINX internet exchanges. The peering footprint: - Microsoft: Azure and Microsoft 365, plus other Microsoft services such as Maps - Amazon Web Services (AWS) - Google Cloud - Major content delivery networks - Local internet exchanges: NAPAfrica, JINX, CINX and DINX Direct peering means your traffic reaches these platforms over dedicated routes rather than crossing the open internet, with engineered headroom for stable performance at peak. That suits real-time apps, data replication and latency-sensitive services. FirstNet operates its own Autonomous System, so these are its own peering relationships, not a resale of someone else's routes. For services hosted further afield, FirstNet maintains multi-peer transit at international hubs including London, New York, Frankfurt and Singapore, across multiple undersea cable systems with automatic rerouting. Peering integrates with FirstNet's private connectivity and security services, and a connectivity assessment can quantify the latency gains for your sites and users. URL: https://www.firstnet.co.za/knowledge/connectivity/which-cloud-platforms-does-firstnet-peer-with-directly/. Reviewed 2026-10-10. #### Which fibre network operators does FirstNet use for business fibre? FirstNet is carrier-agnostic and works with the major ICASA-licensed fibre network operators, such as Vumatel, Frogfoot, Openserve and MetroFibre. It procures Layer 2 access circuits from these operators and runs its own internet service over them, giving you end-to-end IP connectivity from the FirstNet core network to your site. In practice the fibre operator provides the physical line to your building, and FirstNet provides everything above it: the internet service, routing, the managed router, monitoring and support. That model has several benefits: - Feasibility is checked across every operator that may serve your address, not just one. - A primary and a backup link can be placed on different networks for genuine diversity. - Traffic runs on FirstNet's own network, which peers directly at NAPAfrica, JINX, CINX and DINX. - FirstNet coordinates the operator when there is a fault, so you have one point of contact. FirstNet procures last-mile access only from ICASA-licensed operators. Which operator serves a particular site depends on coverage at that address, and is confirmed during feasibility. URL: https://www.firstnet.co.za/knowledge/connectivity/which-fibre-networks-does-firstnet-use/. Reviewed 2026-10-10. #### Which internet exchanges does FirstNet peer at? FirstNet peers directly at NAPAfrica, JINX, CINX and DINX in South Africa, and maintains international transit and peering at hubs including LINX London, New York, Frankfurt and Singapore. An internet exchange point (IXP) is where networks connect to swap traffic directly rather than through third parties. Peering at the major South African exchanges means local traffic reaches local services by a short path: - NAPAfrica: the exchange hosted in Teraco data centres, where FirstNet peers in Johannesburg, Cape Town and Durban - JINX: the Johannesburg Internet Exchange - CINX: the Cape Town Internet Exchange - DINX: the Durban Internet Exchange FirstNet operates its own Autonomous System (AS328366), so these are FirstNet's own peering relationships, not a resale of someone else's routes. Internationally, peering extends to further points such as Amsterdam, Marseille and São Paulo, alongside capacity on seven or more undersea cable systems with automatic rerouting. On top of exchange peering, FirstNet runs direct private peering with Microsoft Azure and Microsoft 365, AWS, Google Cloud and major content delivery networks. URL: https://www.firstnet.co.za/knowledge/connectivity/which-internet-exchanges-does-firstnet-peer-at/. Reviewed 2026-10-10. #### Which mobile network will our FirstNet LTE/5G business connection use? FirstNet is carrier-agnostic for LTE/5G, so it selects the mobile network operator with the best signal and service quality at each site rather than defaulting to one network. Coverage is nationwide wherever LTE/5G signal is present. How the network is chosen and delivered: - FirstNet checks coverage maps or runs an on-site signal test to pick the strongest network at your address. - The service uses a RICA-registered SIM in a pre-configured, FirstNet-managed router. - Speed profiles follow the underlying network plan, with higher speeds possible on 5G. - FirstNet optimises signal and monitors the link. Because the network is chosen per site, a multi-site estate is not tied to one operator's weak spots. LTE/5G is often live within a few working days, which makes it the lead option for temporary sites, pop-ups, construction sites, vehicles and portable units, and a cost-effective failover for fibre. LTE/5G is best-effort with no fixed uptime SLA, because performance varies with network load and signal. Static IPs are available as an option, and FirstNet recommends one for VPN or remote access, since mobile networks often use shared, dynamic addressing by default. URL: https://www.firstnet.co.za/knowledge/connectivity/which-mobile-network-will-our-lte-5g-connection-use/. Reviewed 2026-10-10. #### Which undersea cables and international hubs does FirstNet use? FirstNet carries international traffic across seven or more undersea cable systems, including WACS, EASSy, SEACOM and 2Africa, with automatic rerouting when one is interrupted. It maintains multi-peer transit and peering at global hubs including LINX London, New York, Frankfurt and Singapore, with further international peering points such as Amsterdam, Marseille and São Paulo. The diversity matters because international performance depends on where traffic exits South Africa and how it is routed. If a cable is cut or a region is congested, traffic moves to alternate paths automatically. How this shows up across services: - Business fibre: international contention is limited to a maximum of 1:4, and only during undersea cable failures. - Dedicated Internet Access: dedicated 1:1 contention on international traffic, with peering in hubs including London, New York, Brazil, Germany, Marseilles and Singapore. - Domestic subsea: FirstNet was the first client on 2Africa's Durban to Cape Town segment, which avoids terrestrial fibre cuts and vandalism. - Local traffic: direct peering at NAPAfrica, JINX, CINX and DINX keeps South African traffic in the country. URL: https://www.firstnet.co.za/knowledge/connectivity/which-undersea-cables-and-international-hubs-does-firstnet-use/. Reviewed 2026-10-10. #### Who designs the security policy for FirstNet managed SD-WAN? FirstNet's Security team designs it together with the Connectivity team. Both teams check the SD-WAN design and overlay before anything is quoted or deployed. Security is built into FirstNet SD-WAN from the start, not added later. Security policy enforcement is one of its core jobs, along with path selection, traffic steering and QoS (quality of service). The design runs in five steps: - Outcomes: FirstNet records your business, resilience and security goals. - Underlay check: FirstNet checks multi-link needs and link quality at each site. - Joint sign-off: the Connectivity and Security teams both check the design and overlay. - Rollout and testing: FirstNet builds the approved design and tests it on the chosen underlay links. - Managed service: the network moves to managed services for ongoing support and governance. After rollout, FirstNet manages routing, QoS and security policies from one central point. Changes run through its managed services, Connectivity and Security teams. One SLA covers it all, with one party accountable. Your needs drive the policy, because FirstNet records your security goals at the outcomes step. For Peplink edge devices, FirstNet adds its firewall-as-a-service for perimeter security. URL: https://www.firstnet.co.za/knowledge/connectivity/who-designs-the-security-policy/. Reviewed 2026-10-10. #### Who do I contact at FirstNet when my business internet connection goes down? Log a ticket with the FirstNet support centre at support@firstnet.co.za or through the support portal. FirstNet's Network Operations Centre (NOC) then liaises with the underlying carrier on your behalf, and escalations run through your Service Manager. You deal with FirstNet, not with each carrier. FirstNet acts as the single escalation point across all underlying providers, so you do not have to coordinate between several ISPs when a link fails. Behind the ticket: - Every managed router is on FirstNet's PRTG monitoring platform, with SNMP-based up/down alerting and bandwidth monitoring, so the NOC often sees a fault as it happens. - The NOC handles incident response and works with the carrier on repairs. - Standard broadband support runs during business hours, with after-hours callout for severity 1 issues. The exact cover depends on your service tier and contract. - Where availability targets and service credits apply, FirstNet handles fault escalation, SLA validation and the credit claim with the carrier. Restoration time depends on the last mile: a fibre cut needs physical repair, while a microwave link may need realignment or site access. That is why FirstNet designs critical sites with a diverse backup, so traffic fails over while the primary fault is worked. URL: https://www.firstnet.co.za/knowledge/connectivity/who-do-i-contact-when-something-goes-wrong/. Reviewed 2026-10-10. #### Who is responsible if routing breaks on a FirstNet IP Transit service? Responsibility is split. FirstNet supports the transit backbone and ports, while routing policy, traffic engineering, ASN and IP space compliance remain the customer's responsibility. This clear support boundary reflects how IP Transit works: you control routing policy and traffic engineering, and FirstNet provides uncontended, capacity-based transit. In practice: - FirstNet: the SLA and support cover the FirstNet transit domain, backbone and ports. - You: routing policy, including the routes you announce and accept, plus traffic engineering decisions. - You: your ASN and the compliance of the IP address space you announce. - Onboarding: FirstNet validates your ASN and routing capability, provisions the port, sets up the BGP session and tests end to end before handover. On FirstNet's side, the backbone is watched by a 24/7 NOC with telemetry, alerts and real-time dashboards, and incidents follow ITIL-aligned incident, problem and change management. If you would rather not carry routing responsibility, Dedicated Internet Access is the managed alternative, where FirstNet runs the routing and you receive static public IP addressing. URL: https://www.firstnet.co.za/knowledge/connectivity/who-is-responsible-if-routing-breaks/. Reviewed 2026-10-10. #### Who manages FirstNet SD-WAN after it is deployed? FirstNet does. Once the approved SD-WAN design has been rolled out and tested, FirstNet hands it over to its managed services team for in-life support and ongoing service governance. What managed SD-WAN covers: - Centralised visibility across all sites - Routing, Quality of Service and security policies managed centrally - Changes and escalations handled by FirstNet's managed services, Connectivity and Security teams - A single accountable SLA, covering the underlay circuits too where FirstNet supplies them - Monitoring and fault coordination across the links underneath This matters because SD-WAN is policy-driven: its value comes from keeping policies aligned with how the business uses its applications. A managed service keeps that governance consistent across every site, which suits retail and branch networks where uptime drives revenue, municipalities that need standardised behaviour across many sites, and cloud-heavy enterprises. Where FirstNet also supplies the broadband, DIA, LTE/5G, microwave or LEO satellite underlays, faults on the circuits and the overlay go to the same team, so there is one point of contact whatever the cause. URL: https://www.firstnet.co.za/knowledge/connectivity/who-manages-sd-wan-after-it-is-deployed/. Reviewed 2026-10-10. #### Who owns the guest data collected through FirstNet Managed Guest Wi-Fi? You do. Your organisation remains the data controller for its guest dataset, and the platform supports consent-based login and data capture aligned to POPIA and GDPR. Being the data controller (the responsible party, in POPIA terms) means you decide why and how guest data is used, and you are accountable for it. In practice: - You approve the terms and privacy wording shown on the portal. - You choose the login method, such as email, mobile, social, or OTP via SMS or WhatsApp. - You set retention and decide on downstream use, such as CRM, loyalty or campaigns. - The Capture tier builds a consented first-party database you can use for analytics and reporting. Those choices determine the compliance outcome, and FirstNet helps set them up correctly. FirstNet provides portal design, login configuration, site set-up, reporting access, change control and support, and confirms the hosting region per deployment through its compliance process. The Purple platform that holds the data is ISO 9001 and ISO 27001 certified, with annual third-party audits and ongoing vulnerability and penetration testing. URL: https://www.firstnet.co.za/knowledge/connectivity/who-owns-the-guest-data-collected-through-our-wi-fi/. Reviewed 2026-10-10. #### Who owns the router FirstNet installs at our site for business broadband? FirstNet does. The router (customer premises equipment, or CPE) supplied with a FirstNet broadband link is a FirstNet-managed device that remains FirstNet property and is covered by FirstNet's maintenance and replacement policies. Managing the router is how FirstNet monitors the link and resolves faults quickly. Practical implications: - The router is added to FirstNet's PRTG monitoring platform for up/down alerting and bandwidth monitoring from day one. - FirstNet configures and tests it at installation, and the NOC uses it to diagnose faults with the carrier. - Public IP addresses allocated to the service also remain FirstNet property. - If you run your own firewall, it connects behind the FirstNet router on an Ethernet handoff. - Customer-supplied network equipment must be ICASA type-approved and approved by FirstNet's engineering team. Because FirstNet owns and maintains the router, a faulty unit is handled under FirstNet's replacement policy. Your LAN, internal Wi-Fi and firewall configuration remain your responsibility unless they have been separately scoped with FirstNet. URL: https://www.firstnet.co.za/knowledge/connectivity/who-owns-the-router-installed-at-our-site/. Reviewed 2026-10-10. #### Why do SLA and MTTR matter when choosing a business internet provider? The SLA sets expectations and accountability for availability, response and restoration, while MTTR (Mean Time to Restore) reflects how quickly operations actually recover from an outage. Together they show your downtime exposure and help quantify the impact on productivity, customer experience and revenue. Connectivity cost should be weighed against that risk. Downtime can halt operations, delay transactions and billing, and erode customer trust, and its true cost includes lost opportunity, recovery effort and reputational damage. When comparing providers, check for: - A written uptime SLA with service credits - A backup link that can be installed on a different network - A managed, monitored router with 24x7 monitoring - A defined support and escalation path FirstNet acts as a single, accountable escalation point across all underlying providers, so you do not coordinate several ISPs during an outage. Its monitoring tracks latency, packet loss, jitter and link utilisation rather than simple line availability, so degradation can be picked up before users feel it. FirstNet then reduces practical downtime through design: a diverse backup link keeps traffic flowing while a primary fault, such as a fibre cut, is physically repaired. URL: https://www.firstnet.co.za/knowledge/connectivity/why-do-sla-and-mttr-matter-to-the-business/. Reviewed 2026-10-10. #### Why does local internet peering matter for South African businesses? Most South African traffic should not leave the country. Because FirstNet operates its own Autonomous System with direct peering at the major local exchanges, NAPAfrica, JINX, CINX and DINX, traffic between you and local users, banks, platforms and services stays in South Africa instead of hairpinning offshore. Hairpinning is when traffic between two local parties travels via an overseas route and back, adding distance and latency and exposing domestic traffic to international routing problems. Local peering avoids it, which: - Shortens the path and lowers latency - Keeps performance more consistent for local applications, voice and payments - Reduces dependence on international capacity for domestic traffic - Pairs with FirstNet business fibre, which is uncontended on local (on-net) traffic FirstNet's own Autonomous System (AS328366) means these are FirstNet's peering relationships, not a resale of someone else's routes, and its NAPAfrica peering covers Johannesburg, Cape Town and Durban. For traffic that must go international, FirstNet adds multi-peer transit at global hubs including LINX London, New York, Frankfurt and Singapore, and capacity on seven or more undersea cables with automatic rerouting. URL: https://www.firstnet.co.za/knowledge/connectivity/why-does-local-internet-peering-matter-for-south-african-businesses/. Reviewed 2026-10-10. #### Why use a managed connectivity provider like FirstNet instead of buying circuits from each carrier? A managed connectivity provider such as FirstNet gives you one party to hold to account, not several vendors to juggle. One contract and one service level cover each site and link, and one number reaches FirstNet's 24/7 Network Operations Centre. A basic ISP usually just delivers an access line. Your own team must then juggle several providers, performance problems, fault fixes and security alignment. With managed connectivity, a specialist partner takes charge of how the network performs. With FirstNet, that means: - Carrier-neutral design across all the major fibre and mobile networks in South Africa. - 24x7 monitoring of latency, packet loss, jitter and usage, not just whether a line is up. - Faults handled across all providers and technologies, with FirstNet as your one escalation point. - Central change control for security upgrades, routing tuning and new site cut-ins. - One bill for the whole estate. Live monitoring and automatic failover often restore service before users notice. You also avoid the delays and finger-pointing that come with four or five providers side by side. For finance teams, the result is more predictable running costs and less risk. URL: https://www.firstnet.co.za/knowledge/connectivity/why-use-a-managed-connectivity-provider-instead-of-buying-circuits-from-each-car/. Reviewed 2026-10-10. #### Will FirstNet SD-WAN make our internet faster? No. SD-WAN controls how traffic uses your links; it cannot fix contention or a poor last mile. Its value is predictable, resilient application behaviour across multiple links. What SD-WAN does improve: - Application performance under stress, through application-aware traffic steering and Quality of Service for business-critical applications - Resilience, through dynamic path selection and failover when a link degrades or fails - Use of available capacity, through load balancing across links - Control, through integrated security policy and centralised visibility across all sites Because SD-WAN is an overlay, it performs best on well-designed underlays. If raw speed or consistency is the problem, the fix is in the links themselves: business fibre, Dedicated Internet Access for committed symmetric bandwidth, or a second diverse link. FirstNet supplies carrier-agnostic underlays, typically two diverse links per site, often one fibre and one wireless. If you need a single session, such as a live call, to survive a link failure or to use several links at once, Peplink SpeedFusion bonding works differently: it splits one flow across links at packet level, although the throughput you gain still depends on the links and how they are bonded. URL: https://www.firstnet.co.za/knowledge/connectivity/will-sd-wan-make-our-internet-faster/. Reviewed 2026-10-10. #### Will FirstNet business internet work with our existing firewall or SD-WAN device? Yes. FirstNet hands off Ethernet from its managed router, and your own firewall or SD-WAN device connects behind it. VLAN tagging and IP scheme requirements are confirmed during design. The FirstNet-managed router stays in place because it is how FirstNet monitors the link and resolves faults quickly: every managed router is added to the PRTG monitoring platform with up/down and bandwidth alerting. Your security and overlay devices sit downstream and remain under your control. Points worth knowing: - Your LAN and firewall configuration stays your responsibility unless it has been separately scoped with FirstNet. - Business fibre includes up to two static public IPs by default: one used on the FirstNet router and one available for your own use, for example for VPN or remote access. - Customer-supplied network equipment must be ICASA type-approved and approved by FirstNet's engineering team. - Dedicated Internet Access is compatible with enterprise routing platforms, SD-WAN, firewall and cloud connectivity solutions. If you would rather hand over the overlay as well, FirstNet offers managed SD-WAN, where its Connectivity and Security teams validate the architecture together, and it can supply the fibre, DIA, LTE/5G, microwave and LEO satellite underlays. URL: https://www.firstnet.co.za/knowledge/connectivity/will-you-work-with-our-existing-firewall-or-sd-wan/. Reviewed 2026-10-10. #### Will trees or buildings affect a FirstNet LEO satellite connection? They can. Dense tree canopy or structures in the antenna's field of view can affect performance, so FirstNet validates obstructions during site readiness before committing to an installation. LEO satellites move across the sky rather than sitting in one fixed position, so the antenna needs a broad, clear view of the sky rather than a single line of sight to one point. That is why the site requirements focus on open sky: - A clear view of the sky, usually a roof or open area - A secure mounting position on the building or site - Power available at the installation point - Site access, including permits or safety inductions - Accurate GPS coordinates that plot to the installation roof If the preferred mounting point is partly obstructed, site readiness is the time to look at alternative positions. Where no clear position exists, FirstNet can assess other options for the site, such as licensed microwave, fixed wireless or LTE/5G. Severe weather can also affect satellite connectivity. Where continuity is critical, FirstNet designs LEO into a multi-link solution with intelligent failover. URL: https://www.firstnet.co.za/knowledge/connectivity/will-heavy-obstructions-affect-the-service/. Reviewed 2026-10-10. #### Will we get one bill from FirstNet for all our connectivity sites? Yes. FirstNet operates as one partner across your entire footprint, so you receive one bill, one SLA and one team managing every link, whichever carriers and technologies sit underneath. FirstNet's reach spans every major fibre network operator and mobile network operator in South Africa, but you do not deal with them separately. The single-provider model gives you: - One contract and one unified SLA across every site - One bill, with service delivery, support and billing unified - One 24/7 NOC number for every issue - Centralised change management for system-wide rollouts - One escalation point across all underlying providers This matters most for distributed estates. FirstNet provides centralised management and billing across hundreds of branches for a retail customer, and has more than 5,000 business sites under management in total. A single contract simplifies procurement and vendor management, and avoids the delays and finger-pointing of managing four or five providers in parallel. New sites and services are added to the same arrangement as you grow, with minimal overhead. URL: https://www.firstnet.co.za/knowledge/connectivity/will-we-get-one-bill-for-all-our-sites/. Reviewed 2026-10-10. ### Cloud #### Are we locked in if we use FirstNet Private Cloud? No. With FirstNet Private Cloud you own your data, and an exit with secure deprovisioning and data handover is available under your contract. Why lock-in risk is low: - Data ownership: your data remains yours, and handover on exit is part of the contract scope - Standard hypervisors: workloads run on VMware vSphere or Microsoft Hyper-V, widely used platforms rather than proprietary ones - Hybrid connectivity: private peering to AWS, Azure and Google Cloud keeps other platforms within reach - Building blocks: you consume vCPU, RAM and storage by tier, so you can scale down as well as up Term length, notice periods, renewal mechanics and exit obligations are defined in your contracted terms and conditions, so review them when you sign. FirstNet designs its cloud architecture to deliver performance, compliance and resilience without locking customers into a single vendor or platform. If future flexibility matters to you, raise it during solution design so the exit and data handover approach is clear from the start. The same principle applies to Microsoft licences bought through FirstNet: you keep ownership of your tenant data and can transfer partner of record to another CSP or to Microsoft directly. URL: https://www.firstnet.co.za/knowledge/cloud/are-we-locked-in/. Reviewed 2026-10-10. #### Can FirstNet Private Cloud connect privately to AWS, Azure or Google Cloud? Yes. FirstNet Private Cloud supports private, secure peering with Amazon Web Services (AWS), Microsoft Azure and Google Cloud Platform. This suits hybrid designs and gradual migrations. Your connection options: - Cloud peering: private links to AWS, Azure and Google Cloud that do not rely on the public internet. - Site-to-site VPN: secure tunnels from your offices or data centres. - Internet access: for workloads that face the internet, protected by the virtual firewall. - Private and dedicated links: over FirstNet's carrier-neutral fibre network. A typical use is to keep regulated systems in Private Cloud and use public cloud for burst or development workloads. Another is to move workloads step by step from one platform to another. The sizing workshop works out how you connect and how you separate your systems. For example, some systems may face the internet while others stay private. Production and development may also need to be kept apart. Your connectivity scope also affects how long provisioning takes. If your hybrid design includes Microsoft, FirstNet can also supply Azure through its Microsoft CSP agreement. It can design your Azure landing zone too. For hardware you keep, FirstNet colocation at Teraco sites offers cross-connects to cloud on-ramps such as Azure ExpressRoute and AWS Direct Connect. URL: https://www.firstnet.co.za/knowledge/cloud/can-firstnet-private-cloud-connect-privately-to-aws-azure-or-google-cloud/. Reviewed 2026-10-10. #### Can FirstNet back up Google Workspace? Yes. FirstNet Google Workspace Backup, powered by Druva, protects Gmail, Google Drive including Shared Drives, Calendar and Contacts, as configured. It gives you an independent copy that you can search and restore when data is deleted or encrypted, without running any backup infrastructure. Key points: - Scope: Gmail, Drive and Shared Drives, Calendar and Contacts, as configured - Licensing: per protected user, rather than per gigabyte of storage - Restores: search and restore individual items, files or whole users - Operations: customer-run by default, with an optional FirstNet Managed Backup Service for monitoring, remediation, reporting and restore support - Mixed estates: if you use both Google Workspace and Microsoft 365, the subscriptions can be combined for one approach across both Google keeps the Workspace service running, but under the shared-responsibility model, recovering deleted or encrypted data is your responsibility. Google Vault is designed for retention and eDiscovery inside the platform rather than as an independent restore copy, so regulated organisations often use both. Hosting regions for SaaS backup are confirmed during qualification, as availability varies by service. For data on laptops that is not in Drive, add FirstNet Endpoint Backup. URL: https://www.firstnet.co.za/knowledge/cloud/can-firstnet-back-up-google-workspace/. Reviewed 2026-10-10. #### Can FirstNet combine colocation, private cloud and backup in one solution? Yes. FirstNet designs hybrid solutions in which you keep your own hardware in a FirstNet colocation rack, run other workloads in FirstNet Private Cloud, and protect both with Backup as a Service or Disaster Recovery as a Service, with FirstNet as the single accountable provider. Common combinations include: - Colocation for hardware you want to keep, with Private Cloud for general virtual servers - Private Cloud with Veeam backups to immutable storage as the baseline, plus geographic DR to a second FirstNet data centre - Production in one city and colocation or DR in another, so recovery is geographically separate - Private Cloud peered privately to AWS, Azure or Google Cloud, or colocation cross-connected to cloud on-ramps such as Azure ExpressRoute - Microsoft 365 and endpoint backup alongside server backup, covering data outside your servers Colocated equipment in the Durban data centre can interconnect directly with FirstNet's private cloud and network, and support runs through the 24x7 Rapid Response service desk. You can start with one building block and add others as your needs grow, and FirstNet scopes the combined design, connectivity and recovery objectives in one solution design. URL: https://www.firstnet.co.za/knowledge/cloud/can-colocation-private-cloud-and-backup-be-combined-in-one-solution/. Reviewed 2026-10-10. #### Can FirstNet guarantee our RTO and RPO for backup and disaster recovery? Not by default. FirstNet designs its backup and disaster recovery services to your recovery targets, but these depend on your workloads, bandwidth, change rate and dependencies, so firm RTO and RPO commitments apply only when they are explicitly contracted after scoping and testing. The recovery time objective (RTO) is the maximum downtime you can accept. The recovery point objective (RPO) is the maximum data loss you can accept, measured back from the moment of failure. In FirstNet's design process: - RPO drives backup or replication frequency and the bandwidth you need - RTO drives reserved capacity sizing and the order in which systems start - Application criticality sets the protection tier, for example gold, silver or bronze - Dependencies such as DNS, Active Directory and third-party links affect when a service is truly usable FirstNet runs DR readiness workshops to quantify risk, define RTO and RPO per system and plan failover tests. Scheduled testing then shows whether the targets are achievable in practice. If you need contractual commitments, raise them early so they can be validated through dependency mapping and testing before they are written into your agreement. URL: https://www.firstnet.co.za/knowledge/cloud/can-you-guarantee-our-rto-and-rpo/. Reviewed 2026-10-10. #### Can FirstNet keep our backup data in South Africa? For server and VM backups, yes: the Veeam Data Cloud Vault Non-Core catalogue used by FirstNet Backup as a Service includes South African regions, subject to availability. For Microsoft 365, Google Workspace and endpoint backup, FirstNet confirms hosting regions during qualification, because availability varies by service. Where each type of backup can live: - FirstNet Private Cloud backups: Veeam backups to immutable storage on the FirstNet platform, hosted in Durban, Johannesburg and Cape Town - Backup as a Service: Foundation or Advanced vault editions, with a Non-Core region catalogue that extends to South Africa for residency or latency needs - SaaS and endpoint backup: regions validated against your requirement before quoting, rather than assumed - Disaster recovery replicas: held in a FirstNet data centre in South Africa If you have an in-country-only requirement or work in a regulated industry, raise it at the start. FirstNet captures residency constraints early, documents the agreed hosting location and validates the exact options with specialists before committing. Keeping backups in South Africa supports POPIA-aligned designs, but compliance remains shared: your data classification, retention settings and governance also shape the outcome. URL: https://www.firstnet.co.za/knowledge/cloud/can-backup-data-stay-in-south-africa/. Reviewed 2026-10-10. #### Can FirstNet migrate our servers into a South African data centre? Yes. FirstNet migrates servers into FirstNet Private Cloud, which runs in FirstNet data centres in Durban, Johannesburg and Cape Town on VMware vSphere or Microsoft Hyper-V. FirstNet aligns the target hypervisor to your existing environment to simplify the migration. How the move works: - Discovery and sizing: your VM list, vCPU, RAM, storage tiers, connectivity, backup retention and RTO/RPO are captured - Solution design: segmentation, firewall rules, backup retention and, where needed, a geographic DR runbook are documented - Provisioning: your virtual data centre is built in the Hybr management portal and checked against the design - Migration waves: workloads move in rehearsed, phased cutovers with rollback plans - Handover: you move to 24x7 Rapid Response support with clear contacts and escalation paths A discovery and sizing workshop comes before any migration timeline, and complex migrations get a dedicated technical workshop first. If you would rather keep your own hardware, FirstNet colocation in Durban or in Teraco facilities lets you move servers out of an ageing server room without re-architecting. Either way, your workloads stay in South Africa, with disaster recovery options in a second city. URL: https://www.firstnet.co.za/knowledge/cloud/can-you-migrate-our-servers-into-a-south-african-data-centre/. Reviewed 2026-10-10. #### Can FirstNet migrate us from Google Workspace or on-premises Exchange to Microsoft 365? Yes. FirstNet moves businesses from Google Workspace, on-premises Exchange or older Microsoft 365 tenants onto a current set of Microsoft 365 licences. The work covers identity, moving mail and data, a security baseline, and user adoption. The typical steps: - Tenant readiness review: FirstNet checks your licence mix, identity, MFA, conditional access, Defender, Purview and SharePoint permissions. You sign off the list of fixes. - Identity design: including hybrid identity if you keep Active Directory on your own servers. - Pilot group: tests identity, security settings and how it all works for users, typically over 3 to 6 weeks. - Migration waves: mail and data move in planned groups. - Final cutover and adoption support: users switch over, with help to use the new tools. FirstNet is a Microsoft Cloud Solution Provider (CSP). So it can supply your Microsoft 365 licences on one agreement, billed in rand. It reviews licence sizing every 90 days and assigns licences by persona group. Once you are on Microsoft 365, plan for a separate backup too. Microsoft keeps the service running, but getting back deleted or encrypted data is your job. FirstNet's Microsoft 365 backup, powered by Druva, covers Exchange Online, OneDrive, SharePoint Online and Teams. URL: https://www.firstnet.co.za/knowledge/cloud/can-firstnet-migrate-us-from-google-workspace-or-on-premises-exchange-to-microso/. Reviewed 2026-10-10. #### Can FirstNet support a hybrid cloud approach that mixes private and public cloud? Yes. FirstNet designs hybrid architectures that keep sensitive or regulated systems in private cloud while using public cloud for burst capacity and innovation, with the environments connected privately. How FirstNet builds hybrid environments: - FirstNet Private Cloud, hosted in Durban, Johannesburg and Cape Town, for dedicated, locally hosted workloads with predictable building-block costs - Private peering from Private Cloud to AWS, Microsoft Azure and Google Cloud Platform, so traffic does not rely on the public internet - Azure landing zones for hyperscale and platform-as-a-service workloads, designed before migration waves start - Colocation for hardware you keep, with cross-connects to cloud on-ramps such as Azure ExpressRoute and AWS Direct Connect at Teraco sites - Hybrid identity, connecting on-premises Active Directory to Microsoft Entra ID for single sign-on, MFA and conditional access Hybrid is the most common architecture today, and many organisations use both Private Cloud and Azure. The right split depends on each workload's performance, compliance and cost profile, which FirstNet assesses during discovery. Hybrid designs also suit gradual migrations, where some systems move first and others stay on-premises until they are ready. As a Microsoft CSP, FirstNet can supply the Azure licensing on the same rand-billed agreement. URL: https://www.firstnet.co.za/knowledge/cloud/can-you-support-hybrid-approach/. Reviewed 2026-10-10. #### Can FirstNet support multi-site disaster recovery across cities with colocation? Yes. Multi-site designs are common with FirstNet colocation, for example the Durban data centre paired with a Teraco site in another metro. FirstNet designs around your RPO, RTO and connectivity, and can add Backup as a Service or DRaaS. Typical multi-site patterns: - Production in your own server room or at FirstNet Durban, with DR in a Teraco site in Johannesburg or Cape Town - Production at a Teraco site, with DR at FirstNet Durban or in another Teraco metro - Colocated hardware for production, with FirstNet DRaaS replicating virtual machines to reserved capacity in a FirstNet data centre - Veeam-powered backup sending offsite copies to another location for data recovery A second colocation site gives you a geographically separate recovery facility without owning a second data centre. FirstNet provides connectivity between sites, such as MPLS or SD-WAN links, and coordinates cross-connects at Teraco. To design it, FirstNet needs your RPO and RTO targets, where primary workloads run today and how much data changes each day, because replication bandwidth must match your recovery point objective. Complex DR designs get early specialist input, and recovery targets remain design targets unless explicitly contracted. URL: https://www.firstnet.co.za/knowledge/cloud/can-you-support-multi-site-dr-across-cities/. Reviewed 2026-10-10. #### Can Microsoft CSP licences from FirstNet be used to host services for our own customers? Not by default. Microsoft CSP licences bought through FirstNet are designed for your organisation's own use. If you plan to host services for third parties, talk to FirstNet first so it can review licensing eligibility before you buy. Microsoft's licensing terms distinguish between software your own staff use and software you use to provide services to other organisations. Hosting for third parties is usually covered by separate service-provider licensing arrangements, so the right answer depends on what you are hosting and for whom. When you raise it, FirstNet captures your current agreements, the workloads involved and who will use them, then confirms which licensing route fits. Getting this right up front avoids compliance problems at audit time. URL: https://www.firstnet.co.za/knowledge/cloud/can-csp-licences-be-used-to-host-services-for-our-own-customers/. Reviewed 2026-10-10. #### Can our users keep working during a FirstNet DRaaS failover? Yes, when access is planned in advance. FirstNet designs access and routing so key functions stay online while recovery proceeds, with users and administrators reaching recovered systems in the FirstNet DR site through an agreed secure access model. What makes this work: - Reserved compute, memory and storage, so replicas can start without waiting for capacity - Failover of single VMs or whole groups, in an agreed recovery order - A network model for the DR site, using the same IP ranges or new ranges with address translation - Secure access, such as a hosted firewall VDOM and VPN, scoped in your proposal - Ready dependencies, including DNS and Active Directory During a DR event you declare the incident, replicas are started in the DR site, users connect through the agreed access model, and systems run from DR while your primary site is restored. Failback then returns services to the primary site under change control. Users can only work straight away if dependencies and secure access are ready and the failover order has been agreed and tested. That is why FirstNet captures these details during onboarding and validates them in DR tests. URL: https://www.firstnet.co.za/knowledge/cloud/can-users-work-during-failover/. Reviewed 2026-10-10. #### Can we burst from FirstNet Private Cloud into public cloud? Yes. FirstNet architects hybrid options that link your private estate to Azure or AWS for elastic capacity, so steady workloads run in FirstNet Private Cloud while burst or development workloads use public cloud. How the connection works: - Private peering: FirstNet Private Cloud supports private, secure peering with AWS, Microsoft Azure and Google Cloud Platform, so traffic does not rely on the public internet - Site connectivity: site-to-site VPN, internet access and private dedicated links over FirstNet's carrier-neutral fibre footprint - Azure landing zones: designed by FirstNet before workloads move, with tagging and budget alerts from day one - Licensing: Azure can be supplied through FirstNet's Microsoft CSP agreement on one rand invoice Hybrid designs suit organisations that keep sensitive or regulated workloads private while scaling other workloads into public cloud when required, and they also support gradual migrations. Private Cloud itself is a dedicated IaaS platform, not a public-cloud-style multi-region active/active service. Within it, capacity can be adjusted as demand changes, and site-level failover uses geographic DR to a second FirstNet data centre. FirstNet designs the connectivity and segmentation for hybrid workloads, such as internet-facing versus private-only, during the sizing workshop. URL: https://www.firstnet.co.za/knowledge/cloud/can-we-burst-into-public-cloud/. Reviewed 2026-10-10. #### Can we choose between VMware and Hyper-V on FirstNet Private Cloud? Yes. FirstNet Private Cloud runs on either VMware vSphere or Microsoft Hyper-V, and you choose. Most organisations pick the hypervisor that matches their team's existing skills and the environment they are migrating from, which keeps the migration simpler. What to weigh up: - Existing estate: aligning with your current hypervisor reduces conversion work during migration - Team skills: your administrators keep working with platforms they know - Disaster recovery: FirstNet DRaaS replicates both VMware vSphere and Hyper-V virtual machines - Backup: Veeam protects workloads on either hypervisor Whichever you choose, the platform underneath is the same: Dell PowerEdge clusters, Infinidat tiered storage, high availability and live migration, managed through the Hybr portal. The recommended baseline of a virtual firewall and immutable Veeam backups applies to both. Your preference is captured in the discovery and sizing workshop. It affects provisioning timelines, together with your connectivity scope (internet only, VPN or dedicated links, or hybrid cloud peering) and any firewall or segmentation complexity. Complex migrations with many dependencies or tight downtime windows get a dedicated technical workshop before timelines are committed. URL: https://www.firstnet.co.za/knowledge/cloud/can-we-choose-between-vmware-and-hyper-v-on-firstnet-private-cloud/. Reviewed 2026-10-10. #### Can we keep our data in South Africa with FirstNet cloud services? Yes. FirstNet Private Cloud runs in FirstNet data centres in Durban, Johannesburg and Cape Town, and all FirstNet colocation sites are in South Africa. Your solution design confirms the exact hosting and disaster recovery (DR) sites. It also sets out any data residency wording. Where each service keeps your data: - Private Cloud: virtual machines, storage and immutable backups in FirstNet's Durban, Johannesburg or Cape Town data centres. - Colocation: your own hardware in FirstNet's Durban data centre, or in Teraco sites in Johannesburg, Cape Town and Durban. - Disaster recovery: a second FirstNet data centre in a different city, so DR can stay local too. - Offsite server backups: the Veeam Data Cloud Vault Non-Core catalogue includes South African regions, where available. - Microsoft 365 and Google Workspace backup: hosting regions vary by service. FirstNet confirms them during qualification. Keeping data in the country supports designs aligned with POPIA. But compliance is shared. Your settings, how you classify data and your governance also decide the outcome. If you need specific residency wording in your contract, FirstNet reviews it before it commits in writing. URL: https://www.firstnet.co.za/knowledge/cloud/can-we-keep-our-data-in-south-africa/. Reviewed 2026-10-10. #### Can we leave FirstNet later if we buy Microsoft licences through its CSP agreement? Yes. You keep ownership of your tenant data under Microsoft's terms, and FirstNet supports partner-of-record transfer to another CSP or to direct Microsoft purchasing. Cancellation rules follow the New Commerce Experience (NCE) term you selected. What to know about leaving: - Your data: tenant data stays yours under Microsoft's terms, whichever partner you use - Partner of record: can be transferred to another CSP or to buying direct from Microsoft - Monthly terms: cancellation is possible within the initial 7-day window - Annual and three-year terms: commit you for the term, so plan changes around anniversaries - Mixed terms: you can hold different terms on different licences for more flexibility Choosing terms carefully up front is the best protection. Monthly terms suit pilots, contractors and seasonal staff, annual terms are the default for production, and three-year terms lock the unit price for stable estates. FirstNet plans renewals 90 days ahead and reviews terms against actual usage, so you have a regular point to adjust, reduce or move licences. Managed services, where you have them, are scoped separately and follow their own contract terms. If you also use FirstNet Private Cloud, you own that data too, and an exit with secure deprovisioning and data handover is available under your contract. URL: https://www.firstnet.co.za/knowledge/cloud/can-we-leave-later/. Reviewed 2026-10-10. #### Can we move our Microsoft licences to FirstNet from another CSP? Yes. FirstNet supports partner-of-record transitions from other Cloud Solution Providers and from direct Microsoft purchasing. A tenant readiness review is part of the transition, so any inherited security gaps are documented and prioritised. How the move works: - Discovery: FirstNet captures your current agreements, licence counts, renewal dates and next workload - Tenant readiness review: identity, MFA, conditional access, Defender, Purview and SharePoint permissions are checked - CSP transition: your existing tenant moves to FirstNet as partner of record - Group-based licensing: licences are assigned by persona group, which prevents drift and simplifies audits After the move, you receive one consolidated monthly invoice in rand, a right-sizing review every 90 days, and Azure consumption summaries and optimisation reviews if you use Azure. A customer success manager owns the relationship, with quarterly business reviews. Timing matters under Microsoft's New Commerce Experience, because cancellation rules follow the term you originally selected. FirstNet confirms your term dates and renewal timing up front and plans renewals 90 days ahead. If your current CSP also provides managed services, FirstNet scopes any replacement managed service explicitly rather than assuming it. URL: https://www.firstnet.co.za/knowledge/cloud/can-we-move-to-firstnet-from-another-csp/. Reviewed 2026-10-10. #### Can we pilot Microsoft 365 Copilot with FirstNet before rolling it out to everyone? Yes, and starting with a pilot is the recommended approach. A FirstNet Copilot pilot usually involves a defined group of about 50 to 100 users over 6 to 8 weeks, with measurable adoption and value indicators, before you decide whether to scale. How a pilot typically runs: - Confirm licences: pilot users need Microsoft 365 E3, E5, Business Standard or Business Premium as a prerequisite - Prepare data: clean up Purview labels and SharePoint permissions so Copilot only surfaces what people are allowed to see - Choose the cohort: a defined group whose daily work in Word, Excel, PowerPoint, Outlook and Teams suits AI assistance - Support adoption: training and change management so users get value quickly - Measure and decide: review adoption and value indicators, then scale, adjust or stop Copilot is a per-user add-on with an annual commitment by default, so a pilot cohort limits commitment while you learn. FirstNet supplies the licences through its Microsoft CSP agreement on one rand invoice, with readiness and adoption support alongside them. No productivity return is promised up front: the pilot exists to show what Copilot delivers in your organisation. If prerequisites are missing, FirstNet addresses them first, usually through a tenant readiness review. URL: https://www.firstnet.co.za/knowledge/cloud/can-we-pilot-microsoft-copilot-before-rolling-it-out-to-everyone/. Reviewed 2026-10-10. #### Can we run high-density equipment in FirstNet colocation? Yes, within limits. Power in FirstNet colocation scales per rack, but very dense designs may need to be spread across racks to stay within power and thermal limits, so FirstNet sizes it from your equipment list and power draw. How power and cooling are allocated: - Each full rack includes a base allocation of about 2.2 kVA on redundant A and B feeds - Power is metered continuously and can be scaled in steps of about 1.1 kVA, typically up to about 3.3 kVA per rack - Cabinets are 600 mm or 800 mm wide and take equipment up to about 1.2 m deep - N+1 precision cooling with hot and cold aisle containment manages heat loads - Dense workloads can be split across several racks to stay within per-rack limits If you run high-density hardware, such as blade servers or GPU systems, share the equipment list with power draw and cooling requirements, and your target load per rack now and in 12 months. FirstNet's data centre team validates the design. Extremely dense requirements may need a bespoke approach, such as specialised power circuits, which can affect both cost and timing, so raising them early avoids surprises at installation. URL: https://www.firstnet.co.za/knowledge/cloud/can-we-run-high-density-equipment/. Reviewed 2026-10-10. #### Can we use FirstNet Managed DR with our own Veeam licences? No. FirstNet Managed DR can only be added when Veeam Backup & Replication is licensed and provided by FirstNet under the Veeam Cloud & Service Provider (VCSP) programme. If you use Veeam licences bought elsewhere, you can still take Platform-Only DRaaS and run replication and failover yourself. Your options with existing Veeam licences: - Platform-Only DRaaS: FirstNet provides reserved DR capacity, replication tenancy and platform support, and you operate it from your own Veeam console - Backup as a Service Track 2: keep your licences and send offsite backup copies to a FirstNet repository, with an optional managed service - Move to FirstNet VCSP licensing: Managed DR becomes available once an approved migration to FirstNet-provided licensing is confirmed Under the VCSP model, FirstNet supplies Veeam licensing per protected workload as a monthly service rather than a perpetual purchase, and handles licensing administration and support entitlements. Where Veeam Data Platform Premium is in scope, it includes Veeam ONE for monitoring and reporting, which Managed DR uses to track replica health. FirstNet does not sell standalone Veeam licences, so licensing always comes as part of a FirstNet backup or DR service. URL: https://www.firstnet.co.za/knowledge/cloud/can-we-use-managed-dr-with-our-own-veeam-licences/. Reviewed 2026-10-10. #### Do South African businesses need local cloud hosting, and does FirstNet provide it? Often, yes. For latency, POPIA and industry compliance, and data sovereignty, hosting in South Africa is frequently essential, and FirstNet hosts its Private Cloud in its own data centres in Durban, Johannesburg and Cape Town. Local hosting helps in three main ways: - Latency: applications used every day from South African offices respond better when servers are close to users. - Compliance: keeping regulated data in the country supports data sovereignty designs aligned to POPIA and sector rules. - Recovery: with three local data centres you can place disaster recovery in a different region without leaving South Africa. For your own hardware, FirstNet offers colocation in its Durban data centre and in Teraco facilities in Johannesburg, Cape Town and Durban. Where you also use Azure, AWS or Google Cloud, private peering connects those workloads to your locally hosted estate without relying on the public internet. Local hosting does not make you compliant on its own: your configuration, data classification and governance still matter. FirstNet confirms the exact hosting and disaster recovery locations, and any residency wording, in your solution design. URL: https://www.firstnet.co.za/knowledge/cloud/do-south-african-businesses-need-local-hosting/. Reviewed 2026-10-10. #### Do we need FirstNet laptop backup if we already use OneDrive or Google Drive? Often, yes. Not all business data lives in OneDrive or Google Drive, and files kept only on a device can be lost if the device is lost, fails or is hit by local ransomware. FirstNet Endpoint Backup, powered by Druva, protects selected user and device data on Windows, macOS and Linux laptops and desktops. Why sync is not the same as backup: - Files saved outside synced folders are not copied to the cloud at all - Ransomware can encrypt synced files, and the encrypted versions sync too - A lost, stolen or failed laptop takes any unsynced work with it - Sync keeps copies current, but it is not an independent copy you can restore from Endpoint Backup is licensed per protected device, with no backup servers to run. It does not cover Microsoft 365 or Google Workspace application data, which needs its own backup subscription, so organisations often combine Endpoint Backup with Microsoft 365 or Google Workspace Backup. Endpoint backup is most valuable in laptop-heavy organisations where business-critical data lives outside OneDrive or Drive. If nobody owns monitoring and restores, the optional FirstNet Managed Backup Service can run it for you, including restore support when a device is lost or fails. URL: https://www.firstnet.co.za/knowledge/cloud/do-we-need-to-back-up-laptops-if-we-already-use-onedrive-or-google-drive/. Reviewed 2026-10-10. #### Do we need to run backup servers to protect Microsoft 365 with FirstNet? No. FirstNet Cloud Backup Services, powered by Druva, are cloud-native, so there are no backup servers or storage for you to buy, install or maintain. You choose the workloads to protect, and the service keeps an independent copy you can restore from. What you choose: - Microsoft 365 Backup: Exchange Online, OneDrive, SharePoint Online, Teams, Groups and Entra ID, per protected user - Google Workspace Backup: Gmail, Drive including Shared Drives, Calendar and Contacts, per protected user - Endpoint Backup: selected data on Windows, macOS and Linux devices, per protected device - Managed Backup Service: an optional add-on in which FirstNet handles implementation, monitoring, remediation, reporting and restore support You can combine these in any mix under a single FirstNet contract. Because there is no infrastructure to run, the main operational question is who monitors jobs, fixes failures and handles restores, including after hours. If you do not have staff for that, the Managed Backup Service fills the gap. For on-premises or hosted servers and virtual machines, FirstNet Backup as a Service uses Veeam instead: your environment runs Veeam Backup & Replication and sends encrypted copies to a FirstNet cloud vault. URL: https://www.firstnet.co.za/knowledge/cloud/do-we-need-to-run-backup-servers-to-protect-microsoft-365/. Reviewed 2026-10-10. #### Does FirstNet DRaaS support physical servers? Not through replication. FirstNet DRaaS replication is for VMware vSphere and Microsoft Hyper-V virtual machines. Physical servers are protected with FirstNet Backup as a Service instead, and in a disaster their backups can be restored into new virtual machines in the FirstNet DR environment. How the recovery patterns differ: - Virtual machines: replicated into reserved DR capacity and started as replicas during failover, which is the preferred DR architecture - Physical servers: backed up with agents to the offsite vault, then restored into a new VM in the DR site when needed - Physical-to-virtual and physical-to-physical replication: not supported The recover-from-backup approach still makes physical workloads recoverable, but you should expect a longer recovery time than with VM-based replication, because each server has to be restored before it can run. During discovery, FirstNet records which workloads are virtual and which are physical, so that recovery expectations for each are clear in your design. If a physical system is business-critical, raise it early so its recovery time objective can be set realistically and the right mix of Backup as a Service and DRaaS can be scoped. URL: https://www.firstnet.co.za/knowledge/cloud/does-firstnet-draas-support-physical-servers/. Reviewed 2026-10-10. #### Does FirstNet offer isolated recovery for ransomware resilience? Yes. FirstNet maintains offline or logically isolated backup copies, sometimes called air-gapped copies, to ensure a clean recovery path even in a worst-case attack. How isolation fits into FirstNet's layered approach: - Immutable backups: write-once copies that attackers cannot modify or delete during retention - Isolated recovery points: copies kept apart from production for worst-case scenarios - Offsite vault: Backup as a Service sends encrypted copies to a separate cloud vault over an encrypted TLS channel - Isolated test environments: DR tests run in isolated recovery environments that do not affect live production - Threat detection: backup anomaly alerts and malware scanning help catch problems early The aim is to restore from a point you know is clean, contain the blast radius and bring systems back in a controlled order. Regular restore testing and documentation prove that the recovery path works before you need it. FirstNet can run a resilience review to validate backup integrity, recovery times and threat detection coverage. Recovery objectives are defined by application tier during design, so the most critical systems get the strongest protection and the fastest recovery path. URL: https://www.firstnet.co.za/knowledge/cloud/do-you-offer-isolated-recovery/. Reviewed 2026-10-10. #### Does FirstNet only sell cloud platforms, or can it also help with Microsoft licensing? Both. FirstNet is a Microsoft Cloud Solution Provider (CSP) and Microsoft Solutions Partner, so Microsoft 365, Azure and Microsoft security add-ons can sit on one agreement next to your FirstNet Private Cloud, backup, disaster recovery and colocation services. What the CSP agreement covers: - Microsoft 365 Business and Enterprise plans, Azure, Dynamics 365 and Power Platform - Defender, Purview and Entra security and compliance add-ons, and Copilot for Microsoft 365 - One consolidated monthly invoice in rand, with FirstNet handling the US dollar conversion - A licence right-sizing review at onboarding and every 90 days - A monthly Azure consumption summary and a quarterly optimisation review Because one team owns both the licensing and the platform, FirstNet can also design and deliver the migrations that go with it, such as Microsoft 365 moves from Google Workspace or on-premises Exchange, Azure landing zones and Azure Virtual Desktop. Private Cloud can peer privately with Azure, so hybrid designs that mix local hosting and Microsoft cloud services are supported. Enterprise Agreements are not transacted, but FirstNet can advise you and help you move to CSP at renewal. URL: https://www.firstnet.co.za/knowledge/cloud/do-you-only-sell-the-cloud-platform-or-can-you-also-help-with-microsoft-licensin/. Reviewed 2026-10-10. #### Does FirstNet own the Teraco data centre facilities it uses for colocation? No. Teraco runs its own data centres, and FirstNet holds colocation space inside them. FirstNet adds the service layer on top: racks, connectivity, access arranged with Teraco's on-site teams, and one support contact. FirstNet's Teraco space is at Isando (Johannesburg), Cape Town (CT1 and CT2) and Riverhorse (Durban). Who does what at these sites: - Teraco: runs the building, site power and cooling, base physical security and campus rules. - FirstNet: commercials and contracts, rack allocation in its space and power distribution in your racks. It also handles connectivity design and provisioning, access requests, remote hands coordination and support. - You: your own hardware, operating systems and apps, and your authorised access contacts. The site FirstNet does own is its Durban data centre in Durban. FirstNet designs, owns and runs this purpose-built Tier III-standard site. It is certified to ISO/IEC 27001 and ISO 9001. Teraco sites suit clients who need Johannesburg or Cape Town, or dense carrier and cloud ecosystems. They also suit disaster recovery (DR) across more than one city. Teraco Isando also gives access to the NAPAfrica internet exchange and cloud on-ramps. At any site you choose, FirstNet stays your one accountable provider. You do not have to manage several vendors. URL: https://www.firstnet.co.za/knowledge/cloud/does-firstnet-own-the-teraco-facilities/. Reviewed 2026-10-10. #### Does buying Microsoft licences through FirstNet make us POPIA compliant? No, buying Microsoft licences through FirstNet does not make you POPIA compliant on its own. Compliance depends on how you set up and run your tenant, and under POPIA your business remains the responsible party. Licences such as Entra ID, Defender and Purview give you strong controls for identity, security and data governance. FirstNet can help design and deploy them. How the licences help you work in line with POPIA: - Entra ID P1, P2 and Governance: identity, MFA, conditional access and access governance. - Defender XDR: protection from threats across your Microsoft setup. - Purview: data loss prevention, labelling and eDiscovery. - Group-based licensing: a clear, auditable way to give the right controls to the right people. The licences provide the tools. Compliance comes from setting them up for your data, policies and risks, then running them and keeping evidence over time. FirstNet's tenant readiness review checks identity, MFA, conditional access, Defender, Purview and SharePoint permissions. It produces a ranked list of fixes. Microsoft publishes its data residency commitments for each service in its Trust Center. Your tenant readiness review notes where your data is stored. Rules for your sector may add more needs. If you need signed compliance or residency wording, FirstNet reviews it before committing to it in writing. URL: https://www.firstnet.co.za/knowledge/cloud/does-buying-microsoft-licences-make-us-popia-compliant/. Reviewed 2026-10-10. #### Doesn't Microsoft 365 or Google Workspace already back up our data? Not in the way most organisations assume. Microsoft and Google keep their platforms available, but under the shared-responsibility model, recovering deleted or encrypted data and keeping long-term retention is up to you. FirstNet Cloud Backup Services, powered by Druva, give you an independent copy, so recovery does not depend on the platform you are trying to recover. Common situations where an independent backup helps: - A user or administrator deletes important mail, files or a SharePoint site - Ransomware encrypts files that then sync to OneDrive or Google Drive - You need to recover data beyond the platform's retention settings - You need to show auditors that data can be restored FirstNet Microsoft 365 Backup covers Exchange Online, OneDrive, SharePoint Online, Teams, Groups and Microsoft Entra ID, as configured. FirstNet Google Workspace Backup covers Gmail, Drive including Shared Drives, Calendar and Contacts. Both are licensed per protected user, with no backup servers to run and no storage-cap planning. Retention features inside the platform, such as Microsoft Purview or Google Vault, serve compliance and eDiscovery rather than independent restore, so many regulated organisations use both. An optional managed service adds FirstNet-run monitoring and restore support. URL: https://www.firstnet.co.za/knowledge/cloud/doesnt-microsoft-or-google-already-back-up-our-data/. Reviewed 2026-10-10. #### How are FirstNet Private Cloud backups protected against ransomware? FirstNet Private Cloud's recommended baseline uses Veeam backups to immutable storage, so recovery points cannot be changed or deleted until retention expires. Retention is sized to your needs, typically 7, 14 or 30 days. Ransomware and malicious insiders often try to delete or encrypt backups before striking production. Immutable recovery points stay intact for the full retention period, so you keep a clean point to restore from. Layers that protect Private Cloud workloads: - Veeam backup jobs writing to immutable storage, included in the recommended baseline - A virtual firewall, Lite or Enterprise with UTM, for segmentation and controlled access - Encryption of data at rest and in transit - Optional geographic DR to a second FirstNet data centre with a failover runbook - Longer offsite retention, scoped separately, for example through FirstNet Backup as a Service Backup retention and immutability are documented in your solution design. Many customers start with a shorter retention period and extend it as compliance or recoverability requirements tighten. If you need guaranteed restore times, those are scoped separately rather than assumed. Testing restores regularly confirms that recovery works before you need it. URL: https://www.firstnet.co.za/knowledge/cloud/how-are-backups-protected-against-ransomware/. Reviewed 2026-10-10. #### How are immutable backups different from normal backups at FirstNet? Immutable backups are write-once copies that cannot be altered or deleted within the retention window, so attackers cannot encrypt or erase them. FirstNet uses immutable storage for Private Cloud backups and in its Backup as a Service vault to give you a clean recovery point after ransomware. Ransomware often goes after backups first, because traditional backups can be tampered with or encrypted by attackers. If your backups survive intact, you still have a clean point to restore from. How FirstNet applies immutability: - Private Cloud: Veeam backups write to immutable storage as part of the recommended baseline, with retention typically 7, 14 or 30 days - Backup as a Service: data lands in the Veeam Data Cloud Vault encrypted and can be set as immutable for the retention period - Vault editions: both Foundation and Advanced support immutability - Deletion protection: recovery points cannot be changed or deleted until retention expires, which also guards against accidental or malicious deletion Immutability works best as one layer among several. FirstNet also uses encryption in transit and at rest, isolated recovery copies, backup anomaly alerts and regular restore testing. Choose the retention and immutability period during design, because it sets how far back you can recover. URL: https://www.firstnet.co.za/knowledge/cloud/how-are-immutable-backups-different/. Reviewed 2026-10-10. #### How can FirstNet cloud backup help us follow the 3-2-1 backup rule? The 3-2-1 rule calls for an offsite copy of your backups. If you already run Veeam on-premises, you can add FirstNet's Cloud Connect repository and create a backup copy job that sends each nightly backup to a FirstNet cloud vault, giving you a geographically separate copy without new hardware or separate backup software. In brief, the rule says to keep three copies of your data, on two different types of storage, with one copy offsite. FirstNet Backup as a Service provides that offsite copy. How it works: - Your local Veeam backups keep running as normal - A backup copy job sends data over an encrypted TLS channel through Veeam Cloud Connect - The copy lands in the Veeam Data Cloud Vault, encrypted and optionally immutable - GFS retention can keep weekly, monthly and yearly restore points - If a disaster affects both your primary site and your local backups, you restore from the cloud copy You can keep your own Veeam licences (Track 2) or use FirstNet-supplied licensing (Track 1). For residency, choose a Non-Core vault region, which can include South Africa, subject to availability. If you also want FirstNet to run the offsite copies, add the managed service. URL: https://www.firstnet.co.za/knowledge/cloud/how-can-a-cloud-backup-help-us-follow-the-3-2-1-backup-rule/. Reviewed 2026-10-10. #### How do we access our equipment in a FirstNet colocation data centre? Access to FirstNet colocation is a security control. FirstNet registers your authorised contacts and sets up scheduled and emergency access: full racks and cages allow scheduled visits after identity checks, shared racks need escorted access, and remote hands can reduce the need to visit. How access works: - Authorised contacts: only pre-authorised people can enter, and access logs are kept for audit purposes - Scheduled visits: customers with full racks or private cages arrange access for authorised staff, following identity verification and escort procedures - Shared racks: a FirstNet engineer escorts and assists you, to protect other tenants' equipment - Emergency access: 24x7 support facilitates out-of-hours access or troubleshooting - Remote hands: on-site help with reboots, cable checks and visual inspections All sites have 24x7 guarding, biometric access control and CCTV. At Teraco facilities, FirstNet coordinates access requests with Teraco's on-site teams and follows Teraco's campus security rules alongside its own processes, so you still deal with one support contact. Unannounced walk-in access should not be assumed. Tell FirstNet during discovery how often your engineers expect to visit and who needs authorisation, so the right access model is set up from day one. URL: https://www.firstnet.co.za/knowledge/cloud/how-do-we-access-our-equipment/. Reviewed 2026-10-10. #### How does FirstNet Private Cloud differ from running our own on-premises servers? FirstNet Private Cloud delivers dedicated resources with cloud-like automation, elasticity and managed operations, without the hardware burden. Instead of buying, racking and refreshing servers, you consume virtual servers, memory, tiered storage and networking hosted in FirstNet data centres in South Africa. The main differences from running your own servers: - Hardware: FirstNet runs the Dell PowerEdge clusters, Infinidat storage and data centre, so you never buy or refresh equipment - Cost model: capital expenditure cycles are replaced by predictable operating costs, consumed per vCPU, GB of RAM and GB of storage by tier - Scaling: RAM is allocated in 1 GB increments and resources can be adjusted as demand changes - Resilience: high availability restarts VMs on another host if hardware fails, and live migration moves running VMs without downtime - Security and recovery: a virtual firewall and Veeam backups to immutable storage form the recommended baseline - Management: you provision, control and monitor VMs and usage in the Hybr portal You still choose your hypervisor, VMware vSphere or Microsoft Hyper-V, so existing skills carry over. By default FirstNet runs the platform and you manage the operating systems and applications; optional Server Management adds OS monitoring and patching in business hours or 24x7. URL: https://www.firstnet.co.za/knowledge/cloud/how-does-private-cloud-differ-from-on-prem/. Reviewed 2026-10-10. #### How does FirstNet control cloud costs during and after a migration? FirstNet controls cloud costs by right-sizing workloads, applying reserved or predictable capacity where it fits, and implementing cost governance tooling from day one of a migration. What that looks like in practice: - Tagging applied at the Azure landing zone, so spend can be tracked by workload, team or project - Budget alerts at 50%, 80% and 100% of spend, set by default - A monthly Azure consumption summary and a quarterly optimisation review - Reservations or Savings Plans applied once usage is steady, typically 60 to 90 days in - FirstNet Private Cloud consumed as building blocks: per vCPU, per GB of RAM and per GB of storage by tier Cloud cost is driven by design choices, not just resource size. The main drivers are compute and memory allocation, storage performance tiers, connectivity and bandwidth, and your security and resilience requirements. FirstNet uses a consumption-based model, billed monthly in arrears, so you can scale without penalty and keep cost visible. Savings depend on your workloads, so no fixed percentage can be promised. Microsoft licence right-sizing reviews at onboarding and every 90 days also keep licence spend matched to what your users actually need. URL: https://www.firstnet.co.za/knowledge/cloud/how-do-you-control-costs/. Reviewed 2026-10-10. #### How does FirstNet keep Azure costs under control after migration? FirstNet applies tagging at the Azure landing zone, sets budget alerts at 50%, 80% and 100% by default, provides a monthly consumption summary and a quarterly optimisation review, and applies Reservations or Savings Plans once usage is steady, typically 60 to 90 days in. This FinOps approach starts on day one of the migration rather than after the first surprise bill: - Tagging: applied when the landing zone is built, so every resource can be traced to a workload, team or cost centre - Budget alerts: early warnings at 50% and 80% of budget, and a final alert at 100% - Monthly consumption summary: shows where Azure spend is going - Quarterly optimisation review: identifies idle or oversized resources to right-size - Reservations or Savings Plans: applied once your usage pattern is stable The unit price of Azure is the same whether you buy directly from Microsoft or through a CSP, so the real lever is how well consumption is managed. Savings depend on your workloads, so no fixed percentage can be promised. Because FirstNet is a Microsoft CSP, Azure is billed on the same monthly rand invoice as your other Microsoft licences, with FirstNet handling the US dollar conversion. URL: https://www.firstnet.co.za/knowledge/cloud/how-do-you-keep-azure-costs-under-control-after-migration/. Reviewed 2026-10-10. #### How does FirstNet minimise downtime during a cloud migration? FirstNet keeps downtime low during a cloud migration with replication, staged cutovers, rollback plans and after-hours change windows. Your services stay online while workloads move. How a FirstNet migration runs: - Discovery: FirstNet lists your workloads, maps how they depend on each other and checks readiness, so the move starts from a clear baseline. - Landing zone design: FirstNet builds secure private, public or hybrid target environments to suit your compliance and performance needs. - Migration waves: each phased cutover is rehearsed in advance, clearly communicated and backed by a rollback option. - App modernisation: where it adds value, apps are containerised, refactored or automated. - After the move: ongoing monitoring, cost governance and continual tuning. Before wider waves, FirstNet proves the pattern on a small first step that matches your most urgent workload. For example, an Azure landing zone plus a first non-production workload typically takes 4 to 8 weeks. For FirstNet Private Cloud, a discovery and sizing workshop comes before any migration timeline. FirstNet matches the target hypervisor (VMware vSphere or Microsoft Hyper-V) to your current setup to simplify the move. Complex migrations get a dedicated technical workshop before FirstNet commits to timelines. These include moves with many dependencies, tight downtime windows or regulated workloads. URL: https://www.firstnet.co.za/knowledge/cloud/how-do-you-minimise-downtime-during-migration/. Reviewed 2026-10-10. #### How long are FirstNet Private Cloud backups kept? FirstNet Private Cloud backup retention is sized to your requirement and is typically 7, 14 or 30 days. Backups are written to immutable storage, so recovery points cannot be altered or deleted until the retention period ends, which protects against ransomware and accidental or malicious deletion. Choosing a retention period: - 7 days: covers recent mistakes and failures with the smallest storage footprint - 14 days: more time to notice problems, such as corruption discovered after a week - 30 days: a longer window for incidents that go unnoticed for a while - Longer or offsite retention: scoped separately, for example through FirstNet Backup as a Service with GFS retention Many customers start with a shorter period and extend it as compliance or recoverability requirements tighten. Because backup storage is consumed per GB, longer retention increases the storage you use, so the trade-off between recovery window and cost is worth discussing in discovery. Retention, immutability and any compliance-driven recoverability requirement are captured in the discovery and sizing workshop and documented in the solution design. If you need guaranteed restore times, those are scoped separately rather than assumed. URL: https://www.firstnet.co.za/knowledge/cloud/how-long-are-private-cloud-backups-kept/. Reviewed 2026-10-10. #### How long does it take to move into FirstNet colocation? FirstNet colocation projects usually take several weeks of planning, especially when new connectivity or equipment moves are involved. The exact timeline depends on your site, footprint, power needs and the links or cross-connects you need, and FirstNet confirms it during solution design. The onboarding steps: - Design: FirstNet confirms site, space, power, connectivity and access model from your equipment list - Prepare: racks or cages are allocated, power circuits configured and network patching prepared - Install and connect: FirstNet helps rack and cable your equipment while links and cross-connects are provisioned - Test and hand over: A/B power failover, environmental monitors and network links are tested before handover to support Lead times for cross-connects and access approvals, particularly at Teraco sites, depend on the site and the type of interconnect, so they are validated rather than assumed. The aim is to have circuits in place by the time hardware is installed, so testing can happen immediately. If you have a fixed deadline, such as a lease ending, an audit or a peak season, share it early so FirstNet can check feasibility. If you are moving from another colocation provider or closing a data centre, migration or hardware relocation assistance can be scoped. URL: https://www.firstnet.co.za/knowledge/cloud/how-long-does-it-take-to-move-into-colocation/. Reviewed 2026-10-10. #### How much power is included with a FirstNet colocation rack? A full FirstNet colocation rack comes with a base power allocation of about 2.2 kVA, delivered over redundant A and B feeds. Power use is metered continuously, and if you consistently need more you can add capacity in increments of about 1.1 kVA, typically up to about 3.3 kVA per rack. How power is protected at the Durban data centre: - Redundant UPS systems and backup generators holding over 24 hours of full-load fuel - Power and cooling designed with no single point of failure - N+1 precision cooling with hot and cold aisle containment - Around-the-clock monitoring by FirstNet's Rapid Response team Very dense equipment may need to be spread across several racks to stay within per-rack power and cooling limits. If you run high-density hardware, such as blade servers or GPU systems, raise it early so FirstNet can discuss options such as multiple racks or specialised power circuits. Your equipment list and power draw are checked before your space is allocated, and A/B power failover is tested before handover. Sharing your expected load now and in 12 months helps FirstNet allocate the right power from the start. URL: https://www.firstnet.co.za/knowledge/cloud/how-much-power-is-included-with-a-colocation-rack/. Reviewed 2026-10-10. #### How much rack space can we rent in FirstNet colocation? You can rent as little as one rack unit in FirstNet colocation. Shared racks cater for 1 to 9U, quarter-rack (10 to 11U) and half-rack (about 20U) blocks suit moderate needs, and dedicated, lockable 42U full racks suit larger or more security-sensitive deployments. The space options: - Shared rack, per U: from 1U, with your equipment physically separated from other customers and access supervised - Quarter or half rack: larger contiguous blocks in shared enclosures - Dedicated full rack: a 42U locking cabinet for one customer, 600 mm or 800 mm wide, with standard power distribution and structured cabling support - Multiple racks or a private cage: for larger installations Your choice affects access. Full racks and cages allow scheduled visits by authorised staff after identity checks, while shared racks need escorted access. When sizing, think about growth over the next 12 to 24 months as well as today. If a full rack is likely later, starting in a dedicated rack can make sense even if you only fill part of it now. Power is allocated per rack, so FirstNet sizes space and power together from your equipment list. URL: https://www.firstnet.co.za/knowledge/cloud/how-much-rack-space-can-we-rent-in-colocation/. Reviewed 2026-10-10. #### How often does FirstNet recommend testing disaster recovery? FirstNet recommends quarterly DR tests for critical systems and twice-yearly tests for others, with ad-hoc tests after major changes. On FirstNet Managed DR, quarterly test restores from replicas are included by default. What a sensible testing programme looks like: - Tier your applications so the most critical systems are tested most often - Use quarterly test restores to prove that replicas and backups can be recovered - Plan full failover tests, where systems run from the DR site, as separately scoped events with change control - Retest after major changes, such as new servers, network changes or application upgrades - Record outcomes and feed lessons learned back into the runbook and architecture Tests run in isolated recovery environments, so live production is not affected. Each planned test needs agreed scope and success criteria, a test window, available application owners, ready dependencies such as DNS and Active Directory, and an agreed evidence format for auditors or management. On Platform-Only DRaaS your team owns test planning and execution, while on Managed DR FirstNet runs the scheduled test restores and reports the results. Either way, regular testing is what turns a DR plan into a proven recovery capability. URL: https://www.firstnet.co.za/knowledge/cloud/how-often-do-you-test/. Reviewed 2026-10-10. #### How often should we test backup restores, according to FirstNet? At least quarterly is a good benchmark. FirstNet recommends regular restore tests to prove recoverability, and if you cannot show recent restore tests and audit evidence when asked, that is usually the sign to bring in FirstNet managed backup operations. A backup job that reports success does not prove you can recover. Restore tests show that data is intact, that people know the process, and how long recovery actually takes. A practical testing approach: - Test the scenarios you worry about most: a single item, a full user, a full site or a bulk event - Test at least quarterly, and again after major changes - Record results as evidence for auditors and management - Compare restore times with what the business expects, and adjust plans - Assign a named owner, including for failures that happen after hours FirstNet's Managed Backup Service adds monitoring, remediation, reporting and restore support for Microsoft 365, Google Workspace and endpoint backup. For servers, fully managed Backup as a Service includes periodic test restores, and Managed DR includes quarterly test restores from replicas by default. Typical Microsoft 365 restore times range from minutes for a single item to days for a bulk event. URL: https://www.firstnet.co.za/knowledge/cloud/how-often-should-we-test-restores/. Reviewed 2026-10-10. #### How quickly can FirstNet restore deleted Microsoft 365 data? A single email or file typically comes back in minutes with FirstNet Microsoft 365 Backup. A full user's mailbox and OneDrive typically takes hours, and a full SharePoint site or Teams content can take hours to one or two days. Typical restore bands: - Single email or OneDrive file: minutes, driven by search time and Microsoft's responsiveness - Full user (mailbox and OneDrive): hours, driven by data size and Microsoft throttling - Full SharePoint site or Teams content: hours to one or two days, driven by site size, item and version count, and SharePoint throttling - Bulk event across many users: days, managed through a prioritised runbook These are typical ranges, not SLAs. Actual times depend on tenant size, item size, Microsoft throttling and connectivity, and on whether you restore to the original or an alternate location. If restore time is a hard requirement, FirstNet confirms it with a short proof of concept before you commit. For bulk events such as a ransomware incident, planning the restore order in advance makes the biggest difference, which is where the optional Managed Backup Service and regular restore testing help. URL: https://www.firstnet.co.za/knowledge/cloud/how-quickly-can-deleted-microsoft-365-data-be-restored/. Reviewed 2026-10-11. #### How resilient is FirstNet's Durban data centre? FirstNet's Durban data centre is a purpose-built Tier III-standard facility designed, owned and operated by FirstNet, with power and cooling designed to have no single point of failure. It is certified to ISO/IEC 27001 and ISO 9001. Resilience and security features: - Redundant UPS with backup generators holding over 24 hours of full-load fuel - N+1 precision cooling with hot and cold aisle containment - White space kept around 22 °C ± 2 °C and 40 to 50% humidity - 24x7 security, biometric access control, CCTV and fire suppression - Diverse fibre paths from multiple carriers, with direct ties into FirstNet's core network - Environmental monitoring around the clock by FirstNet's Rapid Response team Each rack receives redundant A and B power feeds, A/B failover is tested before handover, and environmental sensors track temperature, humidity and leaks. FirstNet Durban suits KwaZulu-Natal organisations moving out of server rooms, national customers that need a Durban-region DR site, and hybrid designs where colocated hardware connects directly to FirstNet's private cloud. Availability commitments are set out in your contracted SLA rather than as a blanket promise, so raise any contractual uptime requirement with FirstNet during discovery. URL: https://www.firstnet.co.za/knowledge/cloud/how-resilient-is-firstnets-durban-data-centre/. Reviewed 2026-10-10. #### Is Azure cheaper if we buy directly from Microsoft rather than through FirstNet? No. The unit price for Azure is the same whether you buy directly from Microsoft or through a Cloud Solution Provider such as FirstNet. What changes your Azure bill is how well consumption is managed. The levers that actually move Azure cost: - Tagging: applied at the landing zone, so every resource can be traced to a workload or cost centre - Budgets: alerts at 50%, 80% and 100% of spend, set by default - Right-sizing: matching virtual machine and service sizes to real usage - Reservations or Savings Plans: applied once your usage pattern is steady, usually 60 to 90 days in - Regular review: a monthly consumption summary and a quarterly optimisation review from FirstNet Savings depend on your workloads, so no fixed percentage can be promised. The value of buying through FirstNet is the discipline around consumption, plus one monthly rand invoice that consolidates Azure with your other Microsoft licences, with FirstNet absorbing the US dollar conversion. Azure pay-as-you-go is billed on actual consumption. If you are planning a migration, FirstNet designs the landing zone with FinOps built in from day one, so optimisation is actionable rather than retrofitted after the first large bill. URL: https://www.firstnet.co.za/knowledge/cloud/is-azure-cheaper-if-we-buy-directly-from-microsoft/. Reviewed 2026-10-10. #### Is FirstNet DRaaS capacity reserved for us or shared on a best-effort basis? It is reserved. FirstNet DRaaS sets aside virtual CPU, memory and replica storage for each protected workload in advance, rather than relying on capacity becoming available when a disaster happens. Why reservation matters: - Predictability: recovery is planned, even during events that affect several customers at once - Sizing: capacity is matched to your VM count and the vCPU, RAM and disk of each protected server - Isolation: Veeam Cloud Connect allocates compute, storage and network resources per tenant, keeping your data segregated from other customers - Review: capacity is reviewed as workloads change and resized when servers are added or grow This is the main difference between DRaaS and backup. Backup as a Service stores your data but reserves no compute, so restoring whole systems means finding somewhere to run them. DRaaS keeps that place ready. Reserved capacity is sized during onboarding from your workload list and recovery targets. Where reporting is in scope, reserved capacity status is reported, typically monthly or quarterly, so you can see that it still covers the systems in scope. Best-effort public cloud DR is not part of this service. URL: https://www.firstnet.co.za/knowledge/cloud/is-disaster-recovery-capacity-reserved-for-us-or-shared-on-a-best-effort-basis/. Reviewed 2026-10-10. #### Is FirstNet ISO 27001 certified? Yes. FirstNet's information security management system (ISMS) is certified to ISO 27001, and its quality management system (QMS) to ISO 9001. Its own Durban data centre is also certified to ISO/IEC 27001 and ISO 9001. What this means, along with FirstNet's other credentials: - ISO 27001: formal security governance, risk management, change control, monitoring and incident response, all under audit. - ISO 9001: written processes for service delivery and continual improvement. - ICASA licences for electronic communications services and networks (ECS and ECNS). - B-BBEE Level 1 contributor status. The scope of each certificate matters. If you need a named certificate for a certain site or service, FirstNet confirms the scope for that site first. It does this before it commits anything in writing. At Teraco colocation sites, each campus has its own scope. So FirstNet confirms the evidence for the site you choose. A certificate alone also does not make your workloads compliant. Compliance with POPIA and sector rules is shared. FirstNet's certified systems cover the platform. Your own settings, data classification and governance shape the final result. URL: https://www.firstnet.co.za/knowledge/cloud/is-firstnet-iso-27001-certified/. Reviewed 2026-10-10. #### Is FirstNet Private Cloud compliant with POPIA? FirstNet Private Cloud runs under ISO 27001 and ISO 9001 certified management systems and hosts workloads in South Africa. But POPIA compliance is shared, so your own settings, data classification and governance also shape the outcome. What FirstNet provides: - Local hosting in FirstNet data centres in Durban, Johannesburg and Cape Town. This helps keep your data in South Africa. - ISO 27001 governance: security risk management, change control, monitoring and incident response, all under audit. - Platform controls: role-based access control, MFA, encryption at rest and in transit, and central logging. - A recommended baseline: a virtual firewall to split up your network, and Veeam backups that cannot be changed (immutable). What stays with you: under POPIA, your business is the responsible party. You decide what personal information you process, how it is classified, who can access it and how long you keep it. Those choices, and how you set up your virtual machines and apps, decide whether your processing meets the Act. Before it commits anything in writing, FirstNet reviews any specific compliance wording or residency clauses. The same goes for security questionnaires and certification evidence. Raise them early in discovery to keep your project on schedule. URL: https://www.firstnet.co.za/knowledge/cloud/is-the-platform-compliant-with-popia/. Reviewed 2026-10-10. #### Is FirstNet cloud backup the same as Microsoft Purview or Google Vault? No. Microsoft Purview and Google Vault focus on compliance, eDiscovery and retention controls inside the platform, while FirstNet Cloud Backup Services, powered by Druva, give you a separate copy you can restore from. Many regulated organisations use both. How they differ: - Purpose: Purview and Vault help you retain, find and hold data for compliance; backup gets data back after deletion or ransomware - Location: Purview and Vault work inside your Microsoft or Google tenant; backup keeps an independent copy outside it - Recovery: backup lets you search and restore individual items, whole users or whole sites - Ownership: backup can be run by your team or by FirstNet as a managed service Because the backup copy sits outside the tenant, recovery does not depend on the platform you are trying to recover. That matters if data is deleted, settings are changed or files are encrypted and synced. If your goal is mainly compliance discovery, Purview licensing is available through FirstNet's Microsoft CSP agreement, and FirstNet can help design and deploy those controls. If your goal is recoverability, start with FirstNet Microsoft 365 or Google Workspace Backup, licensed per protected user. URL: https://www.firstnet.co.za/knowledge/cloud/is-this-the-same-as-microsoft-purview-or-google-vault/. Reviewed 2026-10-10. #### Is FirstNet's cloud infrastructure secure? Yes. FirstNet builds security into its cloud platform from the start, not as an add-on. A well-designed cloud can give you stronger security, visibility and resilience than a traditional server room on site. FirstNet's security and quality systems are certified to ISO 27001 and ISO 9001. Its cloud setups include these controls: - Access rights based on each user's role, plus multi-factor sign-in (MFA) - Encryption of data at rest and in transit (AES-256 and TLS) - Central logging and monitoring, with SIEM integration - Regular vulnerability checks and penetration tests - The recommended Private Cloud baseline: a virtual firewall to split up the network, and Veeam backups to immutable storage Cloud security is still a shared job. FirstNet runs and secures the platform. Your own settings, user access, data classification and governance also shape the result. Workloads run in FirstNet data centres in Durban, Johannesburg and Cape Town. Support runs through the 24x7 Rapid Response service desk. A FirstNet cloud architect can review your security needs as part of the solution design. URL: https://www.firstnet.co.za/knowledge/cloud/is-cloud-infrastructure-secure/. Reviewed 2026-10-10. #### Is backup enough, or do we also need FirstNet Disaster Recovery as a Service? For true continuity, usually not. Backups protect your data, but FirstNet Disaster Recovery as a Service (DRaaS) restores entire services quickly by running them from a FirstNet data centre, so organisations with critical systems typically need both. What each one does: - Backup as a Service: recovers files, application items or whole servers after deletion, corruption or ransomware, from an immutable offsite copy - DRaaS: keeps ready-to-run replicas of your virtual machines on reserved compute, memory and storage, so systems can run during an outage - Both together: day-to-day recoverability plus the ability to keep operating through a site failure Backup alone can be enough when you mainly need retention and restores, and your business can tolerate the time it takes to rebuild servers. DRaaS becomes important when specific systems must keep running and you have clear recovery time targets, for example during a primary site failure, an extended power outage, ransomware recovery or a facility-level disaster. Physical servers are protected through backup and can be restored into virtual machines in the FirstNet DR environment, with a longer recovery time than replicated VMs. A FirstNet DR readiness workshop can tier your applications and show where each option fits. URL: https://www.firstnet.co.za/knowledge/cloud/is-backup-enough/. Reviewed 2026-10-10. #### Is cloud backup the same as disaster recovery, and does FirstNet offer both? No. Backup recovers data after deletion, corruption or ransomware, while disaster recovery keeps reserved capacity ready so whole systems can run from a second site during an outage. FirstNet offers both, Backup as a Service (BaaS) and Disaster Recovery as a Service (DRaaS), on the same Veeam platform, and many businesses need both. The practical differences: - Purpose: BaaS protects and restores data; DRaaS keeps workloads running for business continuity - Capacity: BaaS reserves no compute; DRaaS reserves vCPU, memory and replica storage for you in advance - Recovery: BaaS restores files, application items or full servers; DRaaS starts replicas of your virtual machines in a FirstNet data centre - Workloads: BaaS covers virtual machines and physical servers; DRaaS replication covers VMware vSphere and Microsoft Hyper-V virtual machines Choose BaaS when you mainly need backup copies, retention and file or server restores. Add DRaaS when specific systems must keep running through a site outage and you have clear recovery time and recovery point objectives. Physical servers are protected with BaaS and, in a disaster, can be restored into virtual machines in the FirstNet DR environment. URL: https://www.firstnet.co.za/knowledge/cloud/is-backup-the-same-as-disaster-recovery/. Reviewed 2026-10-10. #### Is secure VPN access to the FirstNet DRaaS recovery site included? Not by default. Secure access to the FirstNet disaster recovery site, such as a hosted firewall VDOM, VPN termination and firewall rules, is scoped and included in your proposal when you need it, so it is never simply assumed. Recovered systems are only useful if your users and administrators can reach them, and that depends on how your network is set up in the DR site and what your applications rely on. What FirstNet confirms during discovery: - Whether users and administrators need secure access during a DR event - Whether a hosted firewall VDOM, a virtual firewall partition, will terminate the VPN tunnel - The network model in DR: the same IP ranges, or new ranges with network address translation - DNS and Active Directory dependencies, and the order in which systems start - Bandwidth, latency and any VPN or MPLS link to the DR site Once agreed, secure access becomes part of your DR design and runbook. In a DR event, users and administrators then reach recovered systems through that agreed access model. Planning it before an incident is what makes immediate access realistic when you need it. URL: https://www.firstnet.co.za/knowledge/cloud/is-secure-vpn-access-to-the-dr-site-included/. Reviewed 2026-10-10. #### Is there a storage limit on FirstNet Microsoft 365 and Google Workspace backup? The service is designed so you do not have to plan around storage caps or capacity calculations. FirstNet Microsoft 365 and Google Workspace Backup are licensed per protected user, and Endpoint Backup per protected device, rather than per gigabyte of backup storage. What this means in practice: - No storage calculators or capacity planning for backup data - Costs scale with the number of users or devices you protect - No backup servers or storage to buy, install or maintain - Retention requirements and any fair-use conditions are confirmed when the service is scoped - Unusual retention needs, such as legal hold, are reviewed separately The main thing to decide up front is retention: how long you need to keep backup data for audit, legal or business reasons. That, together with your top restore scenario and any residency constraints, is confirmed before the service is quoted. This model differs from server backup. FirstNet Backup as a Service for virtual machines and physical servers uses per-workload Veeam licensing plus storage in your chosen Foundation or Advanced vault, so capacity is planned as part of that design. URL: https://www.firstnet.co.za/knowledge/cloud/is-there-a-storage-limit-on-microsoft-365-and-google-workspace-backup/. Reviewed 2026-10-10. #### Should we move to Azure or to FirstNet Private Cloud? Choose by workload. FirstNet Private Cloud suits dedicated, locally hosted virtual infrastructure with predictable building-block costs, while Azure suits hyperscale and platform-as-a-service workloads. Many organisations use both, connected through private peering, and FirstNet can deliver either. A practical way to decide: - Private Cloud: lift-and-shift of existing VMware or Hyper-V servers, regulated or latency-sensitive systems that should stay in South Africa, and predictable consumption per vCPU, GB of RAM and GB of storage - Azure: platform services, global scalability, development and burst workloads, and Azure Virtual Desktop - Both: hybrid designs where sensitive systems stay private and other workloads use Azure, connected privately FirstNet Private Cloud runs in Durban, Johannesburg and Cape Town on VMware vSphere or Microsoft Hyper-V, with a virtual firewall and immutable Veeam backups as the recommended baseline. Azure is delivered through FirstNet's Microsoft CSP agreement, with landing zone design, FinOps and a single rand invoice. Note that Private Cloud is not a public-cloud-style multi-region active/active service: site failover is handled with geographic DR to a second FirstNet data centre. A discovery workshop maps each workload to the right platform before any migration timeline is set. URL: https://www.firstnet.co.za/knowledge/cloud/should-we-move-to-azure-or-to-firstnet-private-cloud/. Reviewed 2026-10-11. #### We already own Veeam. Can we still use FirstNet backup and disaster recovery services? Yes. FirstNet Backup as a Service Track 2 lets you keep your existing Veeam licences and send an offsite copy to FirstNet through Veeam Cloud Connect. For disaster recovery, Platform-Only DRaaS works with your own Veeam licensing, while Managed DR needs Veeam licensing supplied by FirstNet. How each option works with existing Veeam: - BaaS Track 2: you keep running local backups and create a backup copy job to a FirstNet offsite repository, which appears as a target in your Veeam console - BaaS Track 1: FirstNet supplies Veeam Data Platform Premium licensing per VM or physical server, plus the vault, as a monthly service - Platform-Only DRaaS: you replicate VMware or Hyper-V virtual machines into reserved FirstNet DR capacity and start failover from your own console - Managed DR: requires Veeam Backup & Replication licensed and provided by FirstNet under the Veeam Cloud & Service Provider (VCSP) programme With Track 2 you remain responsible for your own Veeam licensing compliance, and you can still use features such as WAN acceleration and GFS retention for the offsite copies. You can also add FirstNet's Managed Backup Service for some or all of those copies. Managed DR becomes available through an approved move to FirstNet-provided licensing. FirstNet does not sell standalone Veeam licences. URL: https://www.firstnet.co.za/knowledge/cloud/we-already-own-veeam-can-we-still-use-firstnet/. Reviewed 2026-10-10. #### We're on a Microsoft Enterprise Agreement. Can we switch to FirstNet CSP licensing? Yes, at your EA renewal. Enterprise Agreements sit outside the Cloud Solution Provider (CSP) programme and FirstNet does not transact them, but FirstNet can advise you now and help you move to CSP licensing when your EA comes up for renewal. How the two models differ: - Billing: an EA is an annual commitment, usually US dollar-denominated, with true-ups; FirstNet CSP is billed monthly in rand on one consolidated invoice - Terms: CSP uses Microsoft's New Commerce Experience, so you can mix monthly, annual and three-year terms across licences - Renewals: CSP terms are reviewed against actual usage, with renewals planned 90 days ahead - Advisory: FirstNet adds 90-day right-sizing, Azure consumption analytics and local escalation Before renewal, share your current agreements, licence counts and renewal dates so FirstNet can map your estate. A Microsoft estate audit, typically 2 to 4 weeks, reviews your licence mix, identity baseline, security posture and Azure consumption, and produces a remediation backlog and right-sizing recommendation. An EA can still suit very large enterprises with a global Microsoft team and a multi-year roadmap. FirstNet can help you weigh that against CSP well before the renewal window closes. URL: https://www.firstnet.co.za/knowledge/cloud/were-on-a-microsoft-enterprise-agreement-can-we-switch/. Reviewed 2026-10-10. #### What Microsoft 365 data does FirstNet cloud backup protect? FirstNet Microsoft 365 Backup, powered by Druva, protects Exchange Online, OneDrive, SharePoint Online, Teams, Groups and Microsoft Entra ID, as configured. It keeps an independent copy outside your Microsoft 365 tenant, so you can search for and restore individual items, whole users or whole sites after deletion or a ransomware incident. What is in and out of scope: - In scope: Exchange Online mail, OneDrive files, SharePoint Online sites, Teams content, Groups and Entra ID, as configured - Not covered by this subscription: Google Workspace, data stored only on laptops, and servers or non-Microsoft 365 applications, unless separately scoped - Licensing: per protected user, with no backup servers for you to run and no storage-cap planning - Operations: run by your team by default, or by FirstNet with the optional Managed Backup Service Typical restore times are minutes for a single email or file, hours for a full user's mailbox and OneDrive, and hours to one or two days for a full SharePoint site or Teams content. These are typical ranges, not SLAs. For laptop data outside OneDrive, add FirstNet Endpoint Backup. For servers and virtual machines, FirstNet Backup as a Service uses Veeam. URL: https://www.firstnet.co.za/knowledge/cloud/what-microsoft-365-data-does-firstnet-cloud-backup-protect/. Reviewed 2026-10-10. #### What SLAs does FirstNet offer for Private Cloud hosting? FirstNet provides enterprise-grade SLAs for availability, incident response and change windows, tailored to your business and set out in your contracted SLA schedule and terms. Response targets, resolution targets and any availability commitments are defined per contract rather than published as blanket figures. What sits behind the SLA: - 24x7 Rapid Response support, with tickets logged by email, phone or portal - Defined escalation paths, from the service desk through service management - Platform support, always included: FirstNet runs the data centre, hardware, virtualisation, core networking and storage - Optional Server Management for OS monitoring, patching and support, in 8x5 business hours or 24x7 tiers - High availability and live migration at the hypervisor layer, plus optional geographic DR to a second FirstNet data centre The SLA applies to the components FirstNet manages and the services you contract. Application management and database administration are outside scope unless separately contracted, so their availability depends on your own operations or an additional agreement. If you need specific uptime, response or recovery commitments, raise them during discovery so they can be designed, sized and written into your contract. FirstNet also operates ISO 27001 and ISO 9001 certified management systems, which govern change control and incident response. URL: https://www.firstnet.co.za/knowledge/cloud/what-slas-do-you-offer/. Reviewed 2026-10-10. #### What can FirstNet Backup as a Service protect? FirstNet Backup as a Service protects VMware and Hyper-V virtual machines and physical servers, with physical servers backed up using agents. The workloads can be on-premises or in a private or public cloud. What you can restore: - Individual files - Application items, where the workload and backup configuration support it - Full virtual machines or physical servers, to the original or an alternate location Microsoft 365, Google Workspace and laptop data are covered by a separate FirstNet cloud backup service powered by Druva, so the two services are often used together in mixed environments. Physical servers can also play a part in disaster recovery: if your site is lost, their backups can be restored into new virtual machines in the FirstNet DR environment. During discovery, FirstNet captures how many virtual machines and servers you have, which hypervisors and operating systems they run, which applications are critical, your retention needs and your most important restore scenario. Those answers determine the vault tier, the retention design and whether FirstNet or your team runs the service day to day. If you have no Veeam environment yet, FirstNet's Veeam-certified engineers can deploy and configure the components for you. URL: https://www.firstnet.co.za/knowledge/cloud/what-can-firstnet-backup-as-a-service-protect/. Reviewed 2026-10-10. #### What connectivity can we get for equipment in FirstNet colocation? FirstNet colocation is carrier-neutral. You can take FirstNet dedicated internet access, MPLS or SD-WAN links straight into your rack, or order cross-connects to other carriers, fibre providers and service partners on site, with FirstNet arranging the ordering and installation. The main options: - FirstNet internet, MPLS or SD-WAN: links into your rack that connect colocated equipment to the internet or your offices - Cross-connects: direct links to other carriers, fibre providers and partner services present on site - NAPAfrica: peering through the internet exchange at Teraco Isando - Cloud on-ramps: private, low-latency connections such as Microsoft Azure ExpressRoute and AWS Direct Connect from Teraco facilities - Diverse fibre paths: multiple carriers into the sites, so a single carrier failure need not cut you off This makes colocation a useful hybrid cloud landing zone or network hub, for example hosting core routers or SD-WAN gateways that connect your branches to cloud services. Colocated equipment at FirstNet Durban can also interconnect directly with FirstNet's private cloud and network. Lead times for cross-connects and cloud on-ramps depend on the site and type of interconnect, so FirstNet confirms them during solution design. Tell FirstNet which providers you need and how many cross-connects you expect now and in 6 to 12 months. URL: https://www.firstnet.co.za/knowledge/cloud/what-connectivity-can-we-get-for-equipment-in-colocation/. Reviewed 2026-10-10. #### What do we need before rolling out Microsoft 365 Copilot with FirstNet? Before rolling out Microsoft 365 Copilot with FirstNet, each user needs a qualifying plan: Microsoft 365 E3, E5, Business Standard or Business Premium. A clean rollout also needs Purview labels and tidy SharePoint permissions, and FirstNet recommends a pilot first. Copilot is an add-on you buy per user. FirstNet recommends a pilot with a set group, typically 50 to 100 users over 6 to 8 weeks, before you scale. Here is a practical checklist to get ready: - Licences: each user needs one of the qualifying Microsoft 365 plans. - Identity: a clean base in Microsoft Entra ID, with MFA and conditional access. - Data labels: Purview sensitivity labels, so sensitive content is classified. - Permissions: clean up SharePoint and Teams access, because Copilot shows whatever a user can already open. - Adoption: training and change management, so people know how to use it well. Copilot works across Word, Excel, PowerPoint, Outlook and Teams. You can also get Copilot Studio through FirstNet's CSP agreement. Copilot is an annual commitment by default. That is another reason FirstNet usually quotes a pilot group first. FirstNet runs the tenant readiness review, the Purview and SharePoint permission clean-up and adoption support alongside the licences. The pilot tracks adoption and value, so you can decide whether to scale on evidence, not guesswork. URL: https://www.firstnet.co.za/knowledge/cloud/what-do-we-need-before-rolling-out-copilot/. Reviewed 2026-10-10. #### What does a quarterly FirstNet Managed DR test include? FirstNet Managed DR includes quarterly test restores from your replicas to prove recoverability, unless a different cadence is contracted. A full failover test, where systems run from the DR site as production, is scoped separately and planned with your change control and stakeholders. A test restore is a planned check that replicas can be recovered, without running production in the DR site. A full failover test starts and operates systems from the DR site, so it needs your application owners, approvals and a communication plan. Tests run in isolated recovery environments, sometimes called a test bubble, so live production is not affected. To schedule a test, FirstNet agrees: - The scope and success criteria, including recovery order and what a pass looks like - The test window and any change freezes - The stakeholders and approvals needed on the day - Dependency readiness: DNS, Active Directory, IP plan, firewall rules and VPN - Access requirements such as MFA, and the evidence or report format you need After each test, FirstNet records outcomes, exceptions and recommendations in a DR test report, and agreed remediation actions feed back into the runbook. On Platform-Only DRaaS, your own team plans and runs DR tests instead. URL: https://www.firstnet.co.za/knowledge/cloud/what-does-a-quarterly-dr-test-include/. Reviewed 2026-10-10. #### What happens before FirstNet starts a Microsoft 365 migration? Before a Microsoft 365 migration starts, FirstNet runs a tenant readiness review covering your licence mix, identity setup, MFA coverage, conditional access, Defender baseline, Purview and SharePoint permissions. You then sign off a prioritised remediation backlog before workload delivery begins. What the review checks: - Licence mix: whether users have the right Microsoft 365 plans for what they need - Identity: how accounts are set up, including any hybrid identity with on-premises Active Directory - MFA and conditional access: how sign-ins are protected - Defender and Purview: your security baseline, labelling and data governance - SharePoint permissions: who can see what, which also matters for a later Copilot rollout The tenant readiness review and pilot cohort typically take 3 to 6 weeks. Migration then usually runs as a pilot group first, followed by migration waves and a final cutover, with user adoption support along the way. The same review is part of moving your licences to FirstNet as partner of record, so inherited security gaps are documented and prioritised rather than carried forward. Fixing them first means the migrated tenant starts from a clean, secure baseline. URL: https://www.firstnet.co.za/knowledge/cloud/what-happens-before-a-microsoft-365-migration-starts/. Reviewed 2026-10-10. #### What happens during a disaster recovery event with FirstNet DRaaS? In a FirstNet DRaaS event, you declare the incident, replicas of your systems are started in the FirstNet DR site, users connect through the agreed secure access model, and you operate from DR until your primary site is restored and services fail back under change control. The five steps: - Declare: you confirm the DR event and which systems need to be recovered - Fail over: replicas start in the FirstNet DR site; on Platform-Only you initiate this, and on Managed DR FirstNet assists as contracted - Connect: users and administrators reach recovered systems through the scoped network model and secure access, such as VPN and firewall rules - Operate: systems run from the DR site while the primary site is repaired - Fail back: services return to the primary site in a controlled way, using a planned runbook and change control How smoothly this goes depends on preparation. Before an incident, FirstNet needs your workload list and what is critical, your RTO and RPO targets, connectivity and secure access details, application dependencies such as DNS and Active Directory, and the recovery order. These are captured during onboarding and proven in DR tests, so the steps are rehearsed rather than improvised. URL: https://www.firstnet.co.za/knowledge/cloud/what-happens-during-a-disaster-recovery-event/. Reviewed 2026-10-10. #### What happens if a whole FirstNet Private Cloud data centre goes down? That is what FirstNet Geographic Disaster Recovery (GDR) is for. With GDR, your Private Cloud workloads replicate to a second FirstNet data centre with reserved compute, memory and storage, a DR firewall and a failover runbook aligned to your agreed RTO and RPO. How protection layers up: - Within a data centre: high availability restarts VMs on another host if hardware fails, and live migration moves running VMs during maintenance - Across data centres: GDR replicates workloads from one FirstNet site to another, using the Durban, Johannesburg and Cape Town footprint - At the DR site: compute, RAM and storage are reserved in advance, with a GDR virtual firewall (Lite) - During an event: a scoped failover runbook sets out the steps, roles and test expectations Without GDR, Private Cloud protects against hardware failure but not the loss of an entire site, because it is not a public-cloud-style multi-region active/active service. GDR is the secondary-site failover model that covers that gap. GDR is scoped during discovery, where your RTO and RPO per workload are captured, and the runbook is documented in the solution design. Recovery targets are design targets unless explicitly contracted. For on-premises systems, FirstNet DRaaS applies the same principle of reserved recovery capacity. URL: https://www.firstnet.co.za/knowledge/cloud/what-happens-if-a-whole-data-centre-goes-down/. Reviewed 2026-10-10. #### What happens to our FirstNet cloud services if our connectivity goes down? FirstNet designs cloud environments with redundant connectivity, failover and disaster recovery built in, so a single link failure does not have to take your systems offline. How much resilience you get depends on the connectivity and recovery options designed into your solution. The building blocks FirstNet uses include: - Carrier-neutral connectivity across multiple fibre providers, so links can be diversified - Private Cloud access over site-to-site VPN, internet or private dedicated links - Diverse fibre paths and multiple carriers at the FirstNet Durban data centre - Disaster Recovery as a Service, with resilient network paths and secure access planned for crisis scenarios - Geographic disaster recovery to a second FirstNet data centre in another city Connectivity is captured during discovery and sizing, together with your recovery time and recovery point objectives (RTO and RPO). If users need to reach recovered systems through a VPN during an outage, secure access, such as a hosted firewall and VPN termination, is scoped explicitly rather than assumed. When something does fail, you log it with FirstNet's 24x7 Rapid Response service desk by email, phone or portal. URL: https://www.firstnet.co.za/knowledge/cloud/what-happens-if-connectivity-goes-down/. Reviewed 2026-10-10. #### What happens to our virtual machines if a FirstNet Private Cloud server fails? FirstNet Private Cloud runs on clustered Dell PowerEdge servers with high availability at the hypervisor level. If a physical host fails, the affected virtual machines restart automatically on another host in the cluster. How the platform handles hardware issues: - High availability: VMs on a failed host restart on a healthy host in the same cluster - Live migration: running VMs move between hosts without downtime, for maintenance or load balancing - Storage resilience: Infinidat arrays with built-in replication sit underneath your VM disks - Platform ownership: FirstNet runs and maintains the hardware, so you never manage physical servers This protects against hardware failure inside a data centre. An automatic restart still means a short interruption for the affected VMs while they boot on the new host, so design critical applications with that in mind. Protection against losing an entire site needs Geographic Disaster Recovery, which replicates workloads to a second FirstNet data centre with reserved capacity and a failover runbook. Backups to immutable storage protect your data separately from both. Platform incidents are handled through FirstNet's 24x7 Rapid Response service desk, and SLA terms are set out in your contract. URL: https://www.firstnet.co.za/knowledge/cloud/what-happens-to-our-virtual-machines-if-a-physical-server-fails/. Reviewed 2026-10-10. #### What if our first full backup to FirstNet BaaS is too large to send over our internet link? FirstNet checks this during discovery. If your initial full backup will not complete over your available bandwidth in time, FirstNet agrees a controlled seeding approach with you before go-live, such as moving the first full backup offline. The first full backup, called seeding, is usually the largest and slowest transfer. After that, jobs send changed data, so ongoing traffic depends mainly on how much your data changes each day. What FirstNet looks at when planning seeding: - The current protected data size and expected monthly growth - Your daily change rate, even as a rough estimate - Available bandwidth and latency to the vault over internet or VPN - Your backup window and any application constraints - Any hard deadline, such as an audit or the end of a contract The final approach depends on data volumes, change rate, bandwidth and the agreed delivery timeline, and source-side compression and deduplication can reduce what has to be transferred. Once jobs are running, FirstNet performs test backups and test restores to verify integrity before onboarding is complete. If you have a fixed date, raise it early so feasibility and an accelerated plan can be checked. URL: https://www.firstnet.co.za/knowledge/cloud/what-if-our-first-full-backup-is-too-large-to-send-over-our-internet-link/. Reviewed 2026-10-10. #### What is Azure Virtual Desktop, and when does it make sense with FirstNet? Azure Virtual Desktop (AVD) and Windows 365 Cloud PC deliver Windows desktops from the Microsoft cloud instead of from physical machines or legacy VDI. FirstNet designs, migrates and can operate these environments for hybrid workers, contractors, BPO seats and cases where data should not leave the cloud. Where it fits: - Hybrid and remote workers who need a consistent Windows desktop wherever they work - Contractors and temporary staff who need access without company laptops - BPO and contact centre seats - Replacing legacy on-premises VDI - Sensitive work where data should stay in the cloud rather than on devices FirstNet's delivery covers the Azure landing zone, host pool design, FSLogix profile management, image management and, if you want it, ongoing day-to-day operations. The two options are bought differently. Azure Virtual Desktop is part of Microsoft Azure and runs on Azure consumption, while Windows 365 Cloud PC is licensed per user per month, much like a Microsoft 365 add-on. Both can be supplied through FirstNet's Microsoft CSP agreement on one rand-billed invoice, alongside your Microsoft 365 licences. URL: https://www.firstnet.co.za/knowledge/cloud/what-is-azure-virtual-desktop-and-when-does-it-make-sense/. Reviewed 2026-10-10. #### What is Backup as a Service (BaaS), and how does FirstNet deliver it? Backup as a Service (BaaS) is a managed offsite backup that keeps an independent copy of your servers in a secure cloud vault, ready to restore when needed. You can recover after deletion, corruption, ransomware or a site outage. FirstNet BaaS runs on Veeam Data Platform Premium. FirstNet delivers the service as a Platinum Veeam Cloud & Service Provider, with Veeam-certified engineers and architects. You get an independent offsite copy without building or running a second site, and you decide what gets protected and how long it is kept. How FirstNet BaaS works: - Back up: Veeam Backup & Replication runs backup or backup copy jobs on the schedule and retention you choose - Connect securely: Veeam Cloud Connect links your environment to FirstNet over an encrypted TLS channel - Store immutably: data lands in the vault encrypted and can be set as immutable for the retention period - Restore on demand: recover files, application items or full VMs and servers to the original or an alternate location It protects VMware and Hyper-V virtual machines and physical servers, which are backed up using agents. The workloads can be on-premises or in a private or public cloud. Microsoft 365, Google Workspace and laptop data are covered by a separate FirstNet cloud backup service powered by Druva, so the two are often used together. There are two licensing tracks. On Track 1, FirstNet supplies Veeam licensing and the vault as a monthly service. On Track 2, you keep your own Veeam licences and send a backup copy job to a FirstNet offsite repository, which appears as a target in your Veeam console. Either way, Veeam ONE monitoring and reporting is included with Data Platform Premium, and GFS retention with weekly, monthly and yearly restore points is supported. You also choose who runs it. In the self-managed model, your IT team monitors jobs, fixes failures and performs restores, while FirstNet runs the cloud repository and infrastructure. In the fully managed model, FirstNet designs and sets up the jobs, monitors them and vault capacity, remediates failures within the agreed scope, assists with or performs restores, runs periodic test restores and sends backup health reports. The managed service can be added on Track 2 as well. The vault comes in two editions. Foundation uses locally redundant storage in one region and is the lower-cost option. Advanced typically spreads data across availability zones for business-critical data. Both are encrypted and support immutability, and the Non-Core region list can include South Africa, subject to availability. Typical steps to go live: - Discovery: your VM and server count, hypervisors, critical applications, retention needs and most important restore scenario - Design: vault edition, region, retention and the operating model - Seeding: if the first full backup will not finish over your link in time, FirstNet agrees a controlled approach, such as moving it offline - Verification: test backups and test restores before onboarding is complete Backup on its own reserves no compute, so restoring whole systems takes longer than failing over. If specific systems must keep running through a site outage, add Disaster Recovery as a Service on the same Veeam platform. URL: https://www.firstnet.co.za/knowledge/cloud/what-is-backup-as-a-service-baas/. Reviewed 2026-10-11. #### What is Disaster Recovery as a Service (DRaaS), and how does FirstNet deliver it? DRaaS (Disaster Recovery as a Service) keeps ready-to-run copies of your critical servers at a second site, so you keep working if your main site fails. FirstNet DRaaS replicates your virtual machines into a FirstNet data centre in South Africa using Veeam Cloud Connect Replication. Backup gets your data back. DRaaS keeps your systems running during an outage, and many organisations need both. Backup as a Service stores your data but reserves no compute, so restoring whole systems means first finding somewhere to run them. DRaaS keeps that place ready: compute, memory and replica storage are reserved for you in advance, so recovery is planned rather than best-effort. Typical scenarios include primary site failure, extended power outages, ransomware recovery and facility-level disasters. What the service includes: - VM-to-VM replication for VMware vSphere and Microsoft Hyper-V - Reserved recovery capacity, sized to the vCPU, RAM and disk of each protected server - Failover of single VMs or whole groups, and controlled failback - Isolated recovery environments for safe DR testing - Tenant isolation, with Veeam Cloud Connect allocating compute, storage and network resources per customer - An optional hosted firewall VDOM for VPN access into the DR site Physical servers are not replicated. They are protected with Backup as a Service, and in a disaster their backups are restored into new virtual machines in the FirstNet DR environment, with a longer recovery time than replicated VMs. If your servers already run in FirstNet Private Cloud, the equivalent is Geographic Disaster Recovery to a second FirstNet data centre in another city, with its own DR firewall. You choose how much of the work FirstNet carries. With Platform-Only DRaaS, FirstNet provides the DR infrastructure, reserved capacity, replication tenancy and platform support, and your team runs replication, failover and failback from your own Veeam console. Managed DR adds replica monitoring, quarterly test restores, reporting and, depending on tier, runbooks and assisted failover and failback. Managed DR needs Veeam licensing supplied by FirstNet, while Platform-Only works with your own licences. In a DR event the steps are the same each time: - Declare: you confirm the event and which systems need to be recovered - Fail over: replicas start in the FirstNet DR site, started by you or assisted by FirstNet - Connect: users and administrators reach recovered systems through the agreed secure access model - Operate and fail back: systems run from DR while your primary site is restored, then return under change control What you still decide is which systems matter most and how fast they must return. FirstNet runs DR readiness workshops that tier applications as gold, silver or bronze and set a recovery time objective (RTO) and recovery point objective (RPO) for each. These are design targets, and firm commitments apply only when explicitly contracted after scoping and testing. FirstNet recommends quarterly DR tests for critical systems and twice-yearly tests for the rest, plus a test after any major change. When comparing DRaaS providers, ask where the recovery site is, whether capacity is reserved, who runs failover and how often recovery is tested. FirstNet is a Platinum Veeam Cloud & Service Provider with Veeam-certified engineers, and keeps recovery inside South Africa, with data centres in Durban, Johannesburg and Cape Town. URL: https://www.firstnet.co.za/knowledge/cloud/what-is-disaster-recovery-as-a-service-draas/. Reviewed 2026-10-11. #### What is FirstNet Private Cloud? FirstNet Private Cloud is a South African-hosted Infrastructure as a Service (IaaS) platform: a virtual data centre with virtual machines, compute, memory, tiered storage and segmented networking, without buying or running physical hardware. It runs on VMware vSphere or Microsoft Hyper-V in FirstNet data centres in Durban, Johannesburg and Cape Town. What is inside the platform: - Compute: Dell PowerEdge clusters with Intel Xeon processors, with vCPU allocated at a 2.0 GHz baseline - Memory: RAM allocated in 1 GB increments and adjustable as demand changes - Storage: Infinidat arrays with Tier 1 SSD, Tier 2 Standard and Tier 3 Archive - Resilience: high availability and live migration at the hypervisor layer - Management: the Hybr portal for provisioning, control and monitoring A virtual firewall and immutable Veeam backups form the recommended baseline. You can add Geographic Disaster Recovery to a second FirstNet data centre, and Server Management for OS monitoring and patching in 8x5 or 24x7 tiers. Getting started follows four steps: discovery and sizing, solution design, provisioning in Hybr, and handover to FirstNet's 24x7 Rapid Response support. FirstNet runs the platform, while you manage the OS, applications and data unless you add Server Management. URL: https://www.firstnet.co.za/knowledge/cloud/what-is-firstnet-private-cloud/. Reviewed 2026-10-10. #### What is Microsoft NCE, and which licence term should we choose through FirstNet? NCE (New Commerce Experience) is Microsoft's platform for buying through a Cloud Solution Provider such as FirstNet, offering monthly, annual and three-year terms. Monthly suits pilots, contractors and seasonal staff, annual is the default for production, and three-year terms lock the unit price for stable estates. The terms in more detail: - Monthly: flexible for short-term needs, but cancellation is only possible within the initial 7-day window, and it costs more per seat - Annual: the usual choice for steady production use, balancing commitment and flexibility - Three-year: fixes the unit price for organisations with a long-term Microsoft strategy - Azure pay-as-you-go: billed on actual consumption, with Reservations or Savings Plans once usage is steady You can mix terms across your licences, for example annual for permanent staff and monthly for contractors, all on one rand invoice from FirstNet. The right mix depends on how stable your headcount is and how much change you expect. FirstNet reviews your licences against actual usage at onboarding and every 90 days, and plans renewals 90 days ahead, so you can rebalance between monthly and annual terms as your organisation changes. URL: https://www.firstnet.co.za/knowledge/cloud/what-is-microsoft-nce-and-which-licence-term-should-we-choose/. Reviewed 2026-10-10. #### What is a Microsoft licence right-sizing review from FirstNet? A right-sizing review checks the Microsoft licences you pay for against what your users actually need and use, so you avoid paying for unused or oversized licences, or running short. FirstNet runs one at onboarding and every 90 days after that. What a review looks at: - Unused licences assigned to people who have left or no longer need them - Oversized plans, where a user has a premium plan but only uses basic features - Gaps, where users lack a licence for a feature they need, such as security or compliance add-ons - Term mix, so monthly and annual terms match how stable each group of users is - Upcoming renewals, planned 90 days ahead so terms are reviewed against real usage FirstNet assigns licences to persona-based groups rather than user by user. This keeps the licence mix accurate, prevents drift as people join and leave, and makes audits simpler. Right-sizing is part of FirstNet's standard CSP service, alongside one rand invoice, Azure consumption summaries and quarterly business reviews. For Azure, the equivalent discipline is FinOps: tagging, budget alerts and Reservations or Savings Plans once usage is steady. If you are consolidating several Microsoft contracts, a Microsoft estate audit, typically 2 to 4 weeks, establishes the baseline. URL: https://www.firstnet.co.za/knowledge/cloud/what-is-a-microsoft-licence-right-sizing-review/. Reviewed 2026-10-10. #### What is an Azure landing zone, and why does FirstNet build one before migrating? An Azure landing zone is the foundation your workloads move into: networking, identity, tagging and a security baseline, designed before any migration waves start. FirstNet designs the landing zone and usually moves a first non-production workload to prove the pattern, typically over 4 to 8 weeks. Why it comes first: - Networking: connectivity and segmentation are in place before production traffic arrives - Identity: access is tied to Microsoft Entra ID, with MFA and conditional access - Security baseline: workloads land in an environment that is already secured - Tagging: applied from the start, so cost tracking and optimisation are useful later - Budgets: alerts at 50%, 80% and 100% of spend are set by default Building the landing zone first avoids retrofitting security and cost controls after workloads are already running. Once the pattern is proven, migration waves follow, whether that means lift-and-shift of VMs, a move to platform services, or a mix of both, with FinOps from day one. FirstNet delivers this as a Microsoft Cloud Solution Provider and Solutions Partner, so one team owns both the migration plan and the Azure licensing. After migration, you receive a monthly consumption summary and a quarterly optimisation review, and Reservations or Savings Plans are applied once usage is steady. URL: https://www.firstnet.co.za/knowledge/cloud/what-is-an-azure-landing-zone-and-why-do-we-need-one-before-migrating/. Reviewed 2026-10-10. #### What is hybrid identity, and do we need it before moving to the cloud with FirstNet? Hybrid identity connects your on-premises Active Directory to Microsoft Entra ID, using Entra Connect or Cloud Sync, so people use one identity across on-premises systems and cloud apps. FirstNet often sets it up as the first step before a wider Microsoft 365 rollout or security upgrade. What it enables: - Single sign-on to Microsoft 365 and other software-as-a-service applications - Multi-factor authentication across those applications - Conditional access policies that control who can sign in, from where and on which devices - Group-based licence assignment, which depends on clean identity data - A foundation for Copilot, which relies on accurate identities and permissions It is most relevant if you will keep on-premises Active Directory while adopting cloud services, which is common during a phased migration. Even if you are moving fully to the cloud, identity needs careful design, and FirstNet covers it in the identity design stage of a Microsoft 365 migration. FirstNet checks identity setup, MFA coverage and conditional access as part of the tenant readiness review, and Entra ID P1, P2 and Governance licences can be supplied through FirstNet's Microsoft CSP agreement. URL: https://www.firstnet.co.za/knowledge/cloud/what-is-hybrid-identity-and-do-we-need-it-before-moving-to-the-cloud/. Reviewed 2026-10-10. #### What is included with FirstNet Private Cloud hosting, and are a firewall and backups part of it? FirstNet Private Cloud hosting includes South African-hosted virtual servers, memory, tiered storage and networking on a platform FirstNet runs for you. Every setup starts with a virtual firewall and Veeam backups to immutable storage as the recommended baseline, so it is secure and restorable by default. The platform is Infrastructure as a Service in FirstNet data centres in Durban, Johannesburg and Cape Town. You consume it per vCPU, GB of RAM and GB of storage by tier, without buying or refreshing hardware: - Compute: Dell PowerEdge clusters with Intel Xeon processors, vCPU at a 2.0 GHz baseline - Memory: allocated in 1 GB increments and adjustable as demand changes - Storage: Infinidat arrays with Tier 1 SSD, Tier 2 Standard and Tier 3 Archive - Hypervisor: VMware vSphere or Microsoft Hyper-V, your choice - Resilience: high availability restarts VMs on another host, and live migration moves running VMs without downtime - Management: the Hybr portal to provision, control and monitor your VMs and usage What the baseline covers: - Virtual firewall: Lite, or Enterprise, which adds unified threat management (UTM). Both control access and keep production, development and DMZ zones apart. - Firewall support: an ongoing 8x5 support item for each firewall instance. - Veeam backups: a backup job per virtual machine, written to immutable storage. Retention is typically 7, 14 or 30 days. - Immutability: no one can change or delete a restore point until its retention period ends. If you already have an approved alternative, you can leave out either one. FirstNet then writes down who is responsible for what, and your own security or recovery approach. FirstNet always runs the data centre, hardware, virtualisation, core networking and storage. By default you manage the operating systems, applications and data inside your VMs. Optional extras include Server Management for OS monitoring and patching, in 8x5 or 24x7 tiers, chosen per VM. Another is Geographic DR to a second FirstNet data centre, with its own DR firewall. You can also add private peering to AWS, Azure or Google Cloud, site-to-site VPN, and private dedicated connectivity. From order to live there are four steps: - Discovery and sizing: your VM list, vCPU, RAM, storage tiers, connectivity, retention and RTO/RPO - Solution design: firewall rules, segmentation, backup retention and, where needed, the DR runbook are documented - Provisioning: FirstNet builds your virtual data centre in Hybr and checks it against the design - Handover: you move to 24x7 Rapid Response support with clear contacts and escalation paths Private Cloud protects against hardware failure inside a data centre. Losing a whole site needs Geographic DR. You own your data, and an exit with secure deprovisioning and data handover is available under your contract. FirstNet operates ISO 27001 and ISO 9001 certified management systems, which cover the platform. URL: https://www.firstnet.co.za/knowledge/cloud/are-a-firewall-and-backups-included-with-firstnet-private-cloud/. Reviewed 2026-10-11. #### What is remote hands, and does FirstNet offer it in colocation? Remote hands is on-site help for basic tasks on your equipment when you cannot be there yourself, such as rebooting equipment, checking cables and doing visual inspections. In FirstNet colocation, remote hands is an optional service backed by the 24x7 Rapid Response team. What remote hands typically covers: - Rebooting servers, storage or network devices - Checking cables - Visual inspections, such as status lights and alarms - Help during scheduled or emergency work when your engineers are off-site At Teraco sites, FirstNet coordinates the work with Teraco's 24x7 on-site staff, so you still deal with one support contact. At the FirstNet Durban data centre, FirstNet runs the facility and its processes directly. Remote hands reduces how often your engineers need to travel to the data centre, which is especially useful if your team is in a different city from your equipment, for example with a DR site in another metro. It does not replace managed services: you remain responsible for your hardware, operating systems and applications unless managed services are scoped separately. Tell FirstNet during discovery how often you expect to need on-site help. URL: https://www.firstnet.co.za/knowledge/cloud/what-is-remote-hands-in-a-data-centre/. Reviewed 2026-10-10. #### What is the difference between FirstNet Platform-Only DRaaS and Managed DR? With FirstNet Platform-Only DRaaS, FirstNet provides the DR infrastructure, reserved capacity, replication tenancy and platform support, while your team runs replication and starts failover and failback. Managed DR is an optional add-on in which FirstNet also performs defined DR operational work. What each model covers: - Platform-Only: you configure replication jobs from your own Veeam console, trigger failover and failback, plan DR tests and maintain your recovery order - Managed DR monitoring: FirstNet watches replica jobs, typically through Veeam ONE, and handles alerting and corrective action - Managed DR testing and reporting: quarterly test restores by default, DR status summaries and test reports - Managed DR, depending on tier: documented runbooks, assisted failover and failback during declared DR events, and service reviews Managed DR requires Veeam Backup & Replication licensed and provided by FirstNet under the Veeam Cloud & Service Provider programme. Full failover tests are scoped separately, and secure access such as VPN and firewall policy is included only when explicitly scoped. Support hours and the exact managed scope depend on the service tier you contract. Choose Platform-Only if your team will run tests and failovers itself; choose Managed DR if you want FirstNet to carry that operational load. URL: https://www.firstnet.co.za/knowledge/cloud/what-is-the-difference-between-platform-only-draas-and-managed-dr/. Reviewed 2026-10-10. #### What is the difference between colocation and managed hosting at FirstNet? FirstNet colocation covers the facility: space, power, cooling, physical security and connectivity, while you own and manage your hardware, operating systems and applications. If you want FirstNet to manage servers too, FirstNet Private Cloud or separately scoped managed services are the better fit. How responsibilities split in colocation: - FirstNet provides rack space, redundant A and B power, cooling, physical security, connectivity options, access management and 24x7 support - FirstNet optionally provides remote hands for basic tasks such as reboots, cable checks and visual inspections - You provide your own servers, storage and network equipment, plus the operating systems, applications, patching, backup and monitoring, unless these are sold separately Colocation suits organisations that want data centre resilience while keeping full control of their own hardware, for example when moving out of an ageing server room without re-architecting for cloud. If you would rather not own hardware at all, FirstNet Private Cloud gives you virtual servers on a FirstNet-run platform, and optional Server Management adds OS monitoring, patching and support in business hours or 24x7. Backup as a Service, DRaaS and managed firewall services can also be added to colocated equipment. A discovery session confirms which model fits. URL: https://www.firstnet.co.za/knowledge/cloud/what-is-the-difference-between-colocation-and-managed-hosting/. Reviewed 2026-10-10. #### What is the difference between private cloud and public cloud, and which should we use? Private cloud runs your servers on dedicated infrastructure, public cloud on large shared platforms such as Azure, AWS or Google Cloud. Many organisations use both: steady, regulated systems in private cloud, platform services in public cloud. How to choose for each workload: - Private cloud fits lift-and-shift of existing VMware or Hyper-V servers, regulated or latency-sensitive systems that should stay in South Africa, and budgets that need predictable costs per vCPU, GB of RAM and GB of storage - Public cloud fits platform-as-a-service, global scalability, development and burst workloads, and Azure Virtual Desktop - Both, as hybrid: sensitive systems stay private and other workloads use public cloud, connected privately rather than over the public internet FirstNet delivers either side. FirstNet Private Cloud is a South African-hosted Infrastructure as a Service platform in FirstNet data centres in Durban, Johannesburg and Cape Town, on VMware vSphere or Microsoft Hyper-V, with a virtual firewall and immutable Veeam backups as the recommended baseline. Azure comes through FirstNet's Microsoft CSP agreement, with landing zone design and a single rand invoice. Private peering links Private Cloud to AWS, Azure and Google Cloud Platform. Keep the trade-offs in mind. Private Cloud is not a public-cloud-style multi-region active/active service: site failover is handled with Geographic DR to a second FirstNet data centre. Public cloud gives you more platform services, but costs need active control. Keeping data in South Africa supports POPIA-aligned designs, though compliance still depends on your configuration and governance. A discovery workshop maps each workload to the right platform before any migration timeline is set. URL: https://www.firstnet.co.za/knowledge/cloud/private-cloud-vs-public-cloud/. Reviewed 2026-10-11. #### What is the difference between self-managed and fully managed FirstNet BaaS? With self-managed FirstNet BaaS, your IT team runs the backups day to day using the Veeam tools provided, while FirstNet manages the cloud repository and infrastructure. With fully managed BaaS, FirstNet also acts as your backup operations team. How responsibilities split: - Job configuration: you configure jobs with initial guidance, or FirstNet designs and sets up all jobs, schedules and retention - Monitoring: you watch jobs and storage, or FirstNet proactively monitors jobs and vault capacity - Failures: you troubleshoot and re-run jobs, or FirstNet remediates failures within the contracted scope - Restores: you perform them, or FirstNet assists with or performs restores and runs periodic test restores - Reporting: you use Veeam ONE dashboards, or FirstNet delivers regular backup health, capacity and compliance reports In both models FirstNet runs and supports the cloud backup infrastructure. Managed operations suit organisations without in-house backup expertise, or teams that want to focus on other work. If you keep your own Veeam licences under Track 2, you can still add the managed service for some or all of your backups. Response times and the exact managed scope are set by the service tier in your contract. URL: https://www.firstnet.co.za/knowledge/cloud/what-is-the-difference-between-self-managed-and-fully-managed-baas/. Reviewed 2026-10-10. #### What is the difference between the Foundation and Advanced backup vaults in FirstNet BaaS? Foundation is the lower-cost vault in FirstNet BaaS (Backup as a Service), with data kept redundant in one region. Advanced typically spreads data across availability zones, for business-critical data that needs more resilience. Both are editions of the Veeam Data Cloud Vault that holds your FirstNet offsite backups. How they compare: - Resilience: Foundation uses locally redundant storage in one region. Advanced typically uses zone-redundant storage across several availability zones, where the region supports it. - Data retrieval: Advanced includes more retrieval, which suits frequent restores and tests. - Region choice: Advanced typically lets you choose from more regions than Foundation. - Security: both are always encrypted, and both support immutability (backups that cannot be changed). Each edition comes with a Core or Non-Core region list. Core covers the major cloud regions. Non-Core adds more, such as South Africa, for residency or latency needs, where available. As a rule of thumb, start with Foundation in a Core region if cost matters most and your workloads can recover from one region. Choose Advanced for business-critical data. Pick a Non-Core region if data must stay in a certain country. FirstNet confirms which regions you can use during discovery and quoting. URL: https://www.firstnet.co.za/knowledge/cloud/what-is-the-difference-between-the-foundation-and-advanced-backup-vaults/. Reviewed 2026-10-10. #### What is the right RPO and RTO for our business, and how does FirstNet help set them? There is no single right answer: the right recovery point objective (RPO) and recovery time objective (RTO) depend on how much data loss and downtime each application can tolerate. FirstNet works with your application owners to define business-aligned objectives and then designs the platform to meet them. How FirstNet approaches it: - Classify data and applications by criticality, for example gold, silver and bronze tiers - Set retention and recovery objectives for each tier - Match the technology: backup for data recovery, DRaaS with reserved capacity for systems that must keep running - Check feasibility against bandwidth, change rate and dependencies such as DNS and Active Directory - Prove the targets with regular restore and DR tests RPO drives how often data is backed up or replicated and how much bandwidth you need. RTO drives how much recovery capacity is reserved and the order in which systems start. Tighter targets generally need more capacity and connectivity, so tiering helps you invest where it matters. RTO and RPO are design targets rather than guarantees unless they are explicitly contracted after scoping and testing. A FirstNet DR readiness workshop quantifies risk, defines targets per system and plans the tests that validate them. URL: https://www.firstnet.co.za/knowledge/cloud/whats-the-right-rpo-rto-for-us/. Reviewed 2026-10-10. #### What storage tiers does FirstNet Private Cloud offer? FirstNet Private Cloud offers three storage tiers on Infinidat enterprise arrays: Tier 1 SSD for I/O-intensive workloads, Tier 2 Standard for general server workloads and Tier 3 Archive for data you rarely access. How to use each tier: - Tier 1 (SSD): flash storage for busy databases and latency-sensitive systems - Tier 2 (Standard): balanced performance for general server workloads, such as line-of-business applications and file and print servers - Tier 3 (Archive): low-cost storage for infrequently accessed data Each virtual machine can use the mix that suits it, and latency-sensitive workloads can move up to Tier 1 as your database estate grows. Storage is consumed per GB by tier, so placing data on the right tier keeps costs aligned with performance needs. The Infinidat arrays include intelligent caching and built-in replication. Storage sizing by tier is captured in the discovery and sizing workshop, along with your VM list, vCPU, RAM and backup retention, and any specific performance commitments belong in the solution design. Backups are separate from primary storage: Veeam backup jobs write to immutable backup storage, with retention typically 7, 14 or 30 days. URL: https://www.firstnet.co.za/knowledge/cloud/what-storage-tiers-does-firstnet-private-cloud-offer/. Reviewed 2026-10-10. #### Where are FirstNet Private Cloud workloads hosted? FirstNet Private Cloud workloads are hosted in FirstNet data centres in Durban, Johannesburg and Cape Town. Your hosting location, and your disaster recovery location if you need one, is confirmed in the solution design. What the local footprint gives you: - Data residency: workloads stay in South Africa, supporting POPIA-aligned designs - Latency: servers sit close to South African users and offices - Geographic DR: optional replication to a second FirstNet data centre in a different city - Connectivity: site-to-site VPN, internet and private dedicated links, plus private peering to AWS, Azure and Google Cloud - Credentials: ISO 27001 and ISO 9001 certified management systems, ICASA licensing and B-BBEE Level 1 status Choosing a primary site usually comes down to where your users are and where your other systems run. A common pattern is production in one city with geographic DR in another, so a regional outage does not affect both copies. If your contracts require specific residency wording, FirstNet reviews it before committing in writing. Compliance is shared: the platform is covered by FirstNet's certified management systems, while your configuration, data classification and governance shape the outcome. If you also have hardware to keep, FirstNet colocation in Durban or Teraco sites can sit alongside Private Cloud. URL: https://www.firstnet.co.za/knowledge/cloud/where-are-workloads-hosted/. Reviewed 2026-10-10. #### Where are FirstNet's data centres located? FirstNet hosts Private Cloud workloads in its data centres in Durban, Johannesburg and Cape Town. For colocation, FirstNet owns and operates its own data centre in Durban and holds space in Teraco partner facilities in Isando (Johannesburg), Cape Town (CT1 and CT2) and Riverhorse (Durban). How the sites are used: - Private Cloud: virtual data centres in Durban, Johannesburg or Cape Town, with optional geographic disaster recovery to a second FirstNet data centre - FirstNet Durban: a purpose-built Tier III-standard facility, certified to ISO/IEC 27001 and ISO 9001, suited to a KwaZulu-Natal presence or a Durban DR site - Teraco Isando, CT1, CT2 and Riverhorse: suited to metro choice, carrier density and multi-city DR, with peering through NAPAfrica at Teraco Isando Having three metros means you can keep data in South Africa and still place disaster recovery in a different region. At Teraco sites, Teraco operates the facility and FirstNet provides your service layer, including rack allocation, connectivity, access coordination and a single support contact. Your hosting location, and your disaster recovery location if you need one, is confirmed in your solution design. URL: https://www.firstnet.co.za/knowledge/cloud/where-are-firstnets-data-centres-located/. Reviewed 2026-10-10. #### Where can we colocate our equipment with FirstNet? FirstNet offers colocation in its own data centre in Durban, which it owns and runs. It also has space in partner Teraco sites in Isando (Johannesburg), Cape Town (CT1 and CT2) and Riverhorse (Durban). How to choose a site: - FirstNet Durban: best for a base in Durban or KwaZulu-Natal, or a Durban-region site for disaster recovery (DR). It also suits tightly controlled processes under FirstNet's own facility control. - Teraco Isando: best for a Johannesburg base and dense carrier and cloud ecosystems. It offers NAPAfrica peering and cloud on-ramps such as Azure ExpressRoute and AWS Direct Connect. - Teraco Cape Town (CT1 and CT2): best for a Western Cape base, local hosting or DR. - Teraco Riverhorse: one more KwaZulu-Natal option, for carrier choice or a secondary Durban-region site. The Durban site also links straight into FirstNet's private cloud, backup and network services. At each site, FirstNet is your single accountable provider. That covers commercials, design, connectivity, arranging access and support. Each site also keeps your systems in South Africa. The right site depends on latency, residency, DR diversity and how close it is to your offices. A FirstNet colocation discovery workshop confirms the site, footprint, power, connectivity and timeline. URL: https://www.firstnet.co.za/knowledge/cloud/where-can-we-colocate-our-equipment-with-firstnet/. Reviewed 2026-10-10. #### Where is our data hosted when FirstNet migrates us to the cloud? Sensitive data can remain in South African facilities. FirstNet Private Cloud runs in FirstNet data centres in Durban, Johannesburg and Cape Town, with options for multi-region resilience as needed. Your hosting options depend on the target platform: - FirstNet Private Cloud: virtual machines and immutable backups in FirstNet's Durban, Johannesburg or Cape Town data centres - Geographic disaster recovery: replication to a second FirstNet data centre in a different city - Colocation: your own hardware in the FirstNet Durban data centre or Teraco sites in Johannesburg, Cape Town and Durban - Microsoft 365 and Azure: Microsoft publishes per-service residency commitments in its Trust Center, and residency is documented in your tenant readiness review - Offsite server backups: South African regions are available in the Veeam Data Cloud Vault Non-Core catalogue, subject to availability Hybrid designs are common: regulated systems stay in a local private cloud while other workloads use Azure or AWS through private peering. FirstNet confirms the exact hosting and DR locations, and any residency wording, in your solution design. Compliance with POPIA is shared, so your configuration, data classification and governance also matter. URL: https://www.firstnet.co.za/knowledge/cloud/where-is-data-hosted/. Reviewed 2026-10-10. #### Which FirstNet cloud service should we start with? Start with your most pressing need: Private Cloud replaces on-premises servers, BaaS adds an offsite backup copy, DRaaS keeps systems running in an outage. Colocation hosts your own hardware. A short discovery session with FirstNet usually makes the right starting point clear. As a guide: - Ageing servers or a server room you want to exit: Private Cloud, or colocation if you want to keep your own hardware - No independent offsite copy of your servers: Backup as a Service, powered by Veeam - Systems that must keep running if your site goes down: Disaster Recovery as a Service, with reserved recovery capacity - Microsoft 365, Google Workspace or laptop data at risk: cloud backup powered by Druva - Scattered Microsoft licences and invoices: Microsoft licensing through FirstNet's CSP agreement The services are designed to work together, so you can start with one building block and add others later, with FirstNet as the single accountable provider for design, delivery and support. Many organisations combine them, for example Private Cloud with immutable backups, or production in one city with disaster recovery in another. URL: https://www.firstnet.co.za/knowledge/cloud/which-cloud-service-should-we-start-with/. Reviewed 2026-10-11. #### Which Microsoft products can we license through FirstNet? FirstNet is a Microsoft Cloud Solution Provider and Microsoft Solutions Partner and can license Microsoft 365, Azure, Dynamics 365, Power Platform, security and compliance add-ons, Copilot for Microsoft 365, Windows 365, and Windows and Office volume licensing, all under one CSP agreement. The portfolio: - Microsoft 365: Business Basic, Standard and Premium, and Enterprise E3 and E5, covering Teams, Exchange, SharePoint, OneDrive and Intune - Microsoft Azure: IaaS, PaaS, Azure Virtual Desktop, networking, storage, databases, AI services, Arc, backup and site recovery - Security and compliance: Defender XDR, Purview for DLP and eDiscovery, and Entra ID P1, P2 and Governance - Copilot: Copilot for Microsoft 365 in Word, Excel, PowerPoint, Outlook and Teams, plus Copilot Studio - Dynamics 365 and Power Platform: CRM, ERP including Business Central, and Power Apps, Automate, BI and Pages - Windows and Office: Windows Enterprise and Pro, Office LTSC, Windows 365 Cloud PC and server CALs Everything appears on one monthly rand invoice, with right-sizing every 90 days. Design, migration and managed services can be added where needed. Enterprise Agreements are not transacted, but FirstNet can advise on moving from one at renewal. URL: https://www.firstnet.co.za/knowledge/cloud/which-microsoft-products-can-we-license-through-firstnet/. Reviewed 2026-10-10. #### Which certifications apply to FirstNet colocation sites? The FirstNet Durban data centre is certified to ISO/IEC 27001 and ISO 9001. Teraco certifications are scoped per campus, so FirstNet confirms the evidence for the specific Teraco site you choose before committing to it. What to expect for each site: - FirstNet Durban: ISO/IEC 27001 for information security management and ISO 9001 for quality management - Teraco sites: certifications and attestations vary by campus; customers often ask about ISO standards, PCI DSS and ISAE or SOC-style assurance reports, which FirstNet confirms for the proposed site - FirstNet as a provider: ISO 27001 and ISO 9001 certified management systems, ICASA licensing for ECS and ECNS, and B-BBEE Level 1 status When you need evidence, tell FirstNet which certificate you need, for which scope, and whether it must name the site address. Some assurance reports are only shared under a non-disclosure process. A facility certificate does not cover your own workload. PCI DSS, for example, is workload-specific, so FirstNet can help you map which controls remain your responsibility. All FirstNet colocation sites are in South Africa, which supports POPIA-aligned data residency. URL: https://www.firstnet.co.za/knowledge/cloud/which-certifications-apply/. Reviewed 2026-10-10. #### Who manages the operating system and applications on FirstNet Private Cloud? In the Unmanaged model, FirstNet runs the platform and you manage the operating system, applications and data in your virtual machines. Add FirstNet Server Management and FirstNet handles OS-level monitoring, patching and support in business hours or 24x7. Applications stay with you unless separately scoped. How responsibilities split: - Always FirstNet: data centre, hardware, virtualisation, core networking and storage - Unmanaged (default): you run the OS, applications and data inside your VMs - Server Management 8x5 (optional): FirstNet monitors, patches and supports the OS during business hours, per VM - Server Management 24x7 (optional): the same OS-level support around the clock - Out of scope unless contracted: application management and database administration Because Server Management is chosen per VM, you can apply it where it matters most, for example on critical production servers. Your preference is captured in the discovery and sizing workshop, together with your VM list, storage tiers, connectivity and recovery objectives. Whichever model you choose, support runs through FirstNet's 24x7 Rapid Response service desk, and the recommended baseline still includes a virtual firewall and Veeam backups to immutable storage. If you want application-level support too, it can be scoped as a separate managed service. URL: https://www.firstnet.co.za/knowledge/cloud/who-manages-the-operating-system-and-applications/. Reviewed 2026-10-10. #### Who runs FirstNet Microsoft 365 and Google Workspace backups day to day? By default, your team does. FirstNet Cloud Backup Services are customer-run unless you add the optional Managed Backup Service, in which case FirstNet takes care of monitoring, failed-backup fixes, reporting and restore support. What each model involves: - Customer-run: your team monitors jobs, investigates failures, performs restores and produces any reporting - FirstNet Managed Backup Service: FirstNet handles implementation, monitoring, remediation, reporting and restore support for the subscriptions you have - Either way: the platform is cloud-native, so there are no backup servers or storage for anyone to maintain The managed service does not add workloads. It operates what you have bought and configured, whether that is Microsoft 365, Google Workspace or endpoint backup. A quick test helps you decide. Do you test restores at least quarterly? Is there a named owner for monitoring and failed-backup remediation, including after hours? Can you produce reporting and audit evidence on request without scrambling? If the answer to any of these is no or not sure, the Managed Backup Service is usually worth adding. The same choice exists for server backups: FirstNet Backup as a Service can be self-managed or fully managed, with FirstNet running the cloud infrastructure in both cases. URL: https://www.firstnet.co.za/knowledge/cloud/who-runs-the-backups-day-to-day/. Reviewed 2026-10-10. #### Why buy Microsoft licences through FirstNet instead of directly from Microsoft? Unit pricing is the same either way. Buying through FirstNet, a Microsoft Cloud Solution Provider and Solutions Partner, adds one rand invoice across all Microsoft licences, right-sizing every 90 days, Azure consumption analytics, local technical advisory and a single point of escalation into Microsoft. What the FirstNet CSP service includes as standard: - One consolidated monthly invoice in rand across every Microsoft SKU, with FirstNet absorbing the US dollar conversion - A licence right-sizing review at onboarding and every 90 days - A monthly Azure consumption summary and a quarterly optimisation review - A customer success manager and quarterly business reviews - A FirstNet service desk that triages issues and escalates into Microsoft You can also choose how much FirstNet does beyond licensing: licensing only, licensing plus design and migration, co-managed, or fully managed Microsoft 365 and Azure. Managed services are always scoped separately rather than bundled into a licence quote. Buying direct can work for very small estates. The CSP service matters most when you have several Microsoft contracts, US dollar invoices or a workload roadmap that needs advice. If you have Microsoft Pro Direct or Premier support, it can sit alongside CSP, with FirstNet handling first-line triage and routing deeper platform issues where contracted. URL: https://www.firstnet.co.za/knowledge/cloud/why-buy-through-firstnet-instead-of-directly-from-microsoft/. Reviewed 2026-10-10. #### Will we be billed in rand for Microsoft licences through FirstNet? Yes. Through FirstNet's Microsoft Cloud Solution Provider (CSP) agreement you receive a single consolidated monthly invoice in rand (ZAR) for every Microsoft licence in scope, including Microsoft 365, Azure, Dynamics 365 and security add-ons, with FirstNet handling the US dollar conversion. What this means for your finance team: - One rand-denominated invoice instead of several Microsoft contracts, often billed in US dollars - FirstNet absorbs the USD-to-ZAR translation mechanics under the CSP agreement - One renewal cadence, with renewals planned 90 days ahead - Azure billed on actual consumption, with a monthly consumption summary - Licence right-sizing at onboarding and every 90 days, so you pay for what users need Under Microsoft's New Commerce Experience you can mix terms on the same invoice, for example annual licences for permanent staff and monthly licences for contractors. Three-year terms lock the unit price for stable estates. Unit pricing is the same as buying direct; the difference is consolidation and the service around the licences. FirstNet's customer success manager and quarterly business reviews give finance and IT a single point of contact for licence questions, and the FirstNet service desk escalates technical issues into Microsoft. URL: https://www.firstnet.co.za/knowledge/cloud/will-we-be-billed-in-rand-for-microsoft-licences-through-firstnet/. Reviewed 2026-10-10. ### Security #### Can Cloudflare Access from FirstNet replace our VPN? Yes. Cloudflare Access provides zero trust network access: users reach specific private applications through Cloudflare's edge after identity checks such as single sign-on, MFA and device posture, without a traditional VPN concentrator or inbound listeners on your network. Why this is safer than a VPN: - Access is granted per application, under per-app policy, not to the whole network - No inbound listeners are exposed on your side, which reduces your attack surface - Remote staff and contractors connect through the nearest Cloudflare point of presence, including Johannesburg and Cape Town, without backhauling traffic to head office How FirstNet migrates you: - Integrates Cloudflare Access with your identity provider using SAML or OIDC - Builds the application catalogue with your app owners - Deploys the WARP client where required - Moves user groups across in phases, so the VPN can be retired gradually This also speeds up contractor and partner onboarding, because access is tied to identity rather than network credentials. If your identity provider is not ready for SAML or OIDC at the depth required, FirstNet raises it early and scopes identity remediation first. URL: https://www.firstnet.co.za/knowledge/security/can-cloudflare-replace-our-vpn/. Reviewed 2026-10-10. #### Can FirstNet combine Sophos MDR with backup for ransomware recovery? Yes. FirstNet pairs Sophos MDR with Druva cloud backup, so you have 24/7 detection and response alongside an independent backup copy for recovery. MDR helps detect and contain a ransomware attack, while backup gives you clean data to restore if systems or files are encrypted. How the two layers work together: - Sophos MDR analysts detect suspicious activity and alert, and FirstNet's Incident Response team helps contain the attack - Druva keeps an independent copy of your data, separate from the systems under attack - Once the threat is contained, clean data is restored from backup - For Microsoft 365, Druva backs up Exchange, OneDrive, SharePoint and Teams Detection without backup can leave you unable to recover encrypted data, and backup without detection can let an attacker keep returning. Together they cover both stopping an attack and recovering from one. The two are separate services, so each is scoped to your environment and contracted separately. Retention settings in Microsoft 365 are not a substitute for backup. A FirstNet specialist can scope both as one ransomware-resilience plan. URL: https://www.firstnet.co.za/knowledge/security/can-managed-detection-and-response-be-combined-with-backup-for-ransomware-recove/. Reviewed 2026-10-10. #### Can FirstNet guarantee POPIA compliance for our cybersecurity services? No. No provider can guarantee POPIA compliance on its own. FirstNet aligns each security service to your privacy, retention and audit requirements, but compliance remains a shared responsibility that depends on your configuration and governance. What FirstNet can provide is controls and evidence that support compliance: - Data loss prevention through Netskope or Cloudflare to detect and block POPIA personal information leaving the business - FortiAnalyzer as a Service hosted in South Africa, where log data stays in the country during normal operation - Mimecast, which supports South African data residency preferences, with archiving for retention and legal hold where contracted - Reporting and audit trails from FortiAnalyzer, Sophos NG-SIEM and the other platforms Your organisation remains the responsible party under POPIA, so your obligations to data subjects and your internal governance stay with you. FirstNet itself operates under ISO 27001 and ISO 9001 management systems. If you need formal questionnaires completed or specific contractual wording, such as data residency commitments, FirstNet's product and legal teams review the request before any commitment is made. URL: https://www.firstnet.co.za/knowledge/security/can-you-guarantee-popia-compliance/. Reviewed 2026-10-10. #### Can FirstNet run phishing awareness training and simulations for our staff? Yes. FirstNet can provide or integrate security awareness training and phishing simulations as part of its managed Mimecast email security service, so users learn to spot the attacks that get past technical filters. What is included depends on the Mimecast tier and what you contract: - Essentials includes basic awareness nudges alongside spam, malware and phishing filtering - Resilience, the recommended tier, includes a full awareness training programme - Complete adds executive human-risk reporting - Where awareness is contracted, FirstNet runs the campaigns and simulations and provides reporting on a regular stakeholder cadence Awareness is one layer of FirstNet's email protection. Mimecast also inspects links and attachments in real time and blocks impersonation attempts, and SendMarc stops attackers sending email that uses your exact domain. Training and simulations are optional, so confirm they are in scope during discovery. A FirstNet email security review can benchmark your current risk and recommend the right tier. URL: https://www.firstnet.co.za/knowledge/security/can-we-run-phishing-awareness/. Reviewed 2026-10-10. #### Can FirstNet's Microsoft 365 security service help us meet POPIA and audit requirements? Yes, it helps, but no provider can guarantee POPIA compliance on its own. FirstNet configures Microsoft 365 data protection and compliance controls, and sets up reports and dashboards that support audits and regulatory checks, as part of its Microsoft 365 security and compliance service. Regulatory requirements such as POPIA add pressure for data governance, retention and auditability in Microsoft 365. The controls FirstNet works with include: - Data protection: data loss prevention, sensitivity labels, encryption and retention - Compliance: audit trails, eDiscovery and regulatory reporting - Reporting: dashboards configured for audits and regulatory checks - SIEM integration: alerts and logs forwarded to your SIEM for centralised visibility For a professional services client, this approach achieved POPIA-aligned data governance with minimal user friction. Compliance remains a shared responsibility. Under POPIA your organisation is the responsible party, and the outcome depends on how your tenant is configured and governed over time. FirstNet aligns each service to your privacy, retention and audit requirements, and formal security questionnaires and contract wording are reviewed by its product and legal teams. A Microsoft 365 security assessment, covering a tenant review, gap analysis and prioritised action plan, is the practical place to start. URL: https://www.firstnet.co.za/knowledge/security/can-microsoft-365-security-service-help-us-meet-popia-and-audit-requirements/. Reviewed 2026-10-11. #### Can FirstNet's managed firewall service send logs and alerts to our SIEM? Yes. FirstNet can export firewall logs and alerts to your SIEM, or provide reporting dashboards instead. The integration approach, retention period and any forwarding are confirmed during solution design, because they depend on the firewall platform and service you choose. Options by platform: - Sophos Firewall as a Service: all firewalls log to Sophos Central; Standard Protection keeps logs on the firewall for seven days, Xstream adds 30-day cloud retention, and logs can be forwarded via syslog to a SIEM you manage or retained in the Sophos MDR data lake - Fortinet: FortiAnalyzer as a Service gives Fortinet-native log analytics hosted in South Africa, and log forwarding to an existing SIEM such as Splunk or Sentinel can be scoped separately - Cloudflare and Netskope: logs can be forwarded into your SIEM or reviewed by FirstNet FortiAnalyzer is not a SIEM replacement. It sits closer to your FortiGates and provides out-of-the-box compliance reports, while your SIEM correlates events across all your sources. Raise SIEM forwarding, retention periods and custom dashboards early in discovery, because they can change the service scope and storage sizing. URL: https://www.firstnet.co.za/knowledge/security/can-you-integrate-with-our-siem/. Reviewed 2026-10-10. #### Can Netskope Private Access from FirstNet replace our VPN? Yes. Netskope Private Access replaces traditional VPN access with app-level zero trust access, so users reach only the applications they are allowed to use, rather than being placed on the network as a whole. How it differs from a VPN: - Access is granted per application, based on identity and policy, which supports least-privilege access - Users are not given broad network access, which limits what a compromised account can reach - It runs on the same platform, client and console as Netskope's web gateway, CASB and DLP How FirstNet rolls it out: - Discovery of who needs access, what they access and what is not working with the current VPN - Set-up of admin access, identity integration, traffic steering and first access rules - A pilot with a smaller user group, then production rollout - Ongoing tuning of Private Access rules after go-live VPN replacement is a common starting point, and many organisations later expand into wider SSE controls and digital experience visibility. FirstNet can supply, deploy, co-manage or fully manage the platform, depending on how much your team wants to run itself. URL: https://www.firstnet.co.za/knowledge/security/can-netskope-replace-our-vpn/. Reviewed 2026-10-10. #### Can Netskope from FirstNet control how our staff use AI tools? Yes. Netskope, delivered by FirstNet, can identify and control AI app usage and help prevent sensitive data being exposed through AI interactions, such as prompts containing confidential information. How Netskope addresses AI risk: - CASB shows which SaaS and AI tools staff are using, including unsanctioned shadow AI - Policies control how those AI apps may be used - DLP inspects prompts sent to AI tools and can stop sensitive data, such as POPIA personal information, payment data or credentials, leaving the business - Reporting shows AI usage trends to security teams and leadership Organisations with AI governance concerns often expand into Netskope's AI security capabilities alongside CASB, DLP and analytics, and FirstNet can help design the guardrails and run the policy operations. Policies are tuned after go-live, so controls can be refined as you learn how staff actually use AI, rather than blocking useful tools outright. If you already run Sophos, FirstNet also offers Sophos Secure AI for shadow AI discovery, prompt monitoring and AI data loss prevention, with AI risk monitored by Sophos MDR. URL: https://www.firstnet.co.za/knowledge/security/can-it-control-how-staff-use-ai-tools/. Reviewed 2026-10-10. #### Can we add Sophos MDR to our FirstNet Sophos Firewall as a Service? Yes. Sophos MDR is a separate service that attaches to Sophos Firewall as a Service on the same monthly bill. With Sophos endpoints, Synchronized Security can also isolate compromised devices automatically. What adding MDR gives you: - Sophos analysts monitoring, hunting and alerting 24/7 - FirstNet's Incident Response team acting on Sophos alerts with you, under a runbook agreed during onboarding - Longer log retention through the Sophos MDR data lake, beyond the firewall's own seven-day or 30-day retention - With Xstream Protection, a connector that feeds firewall telemetry into MDR and XDR MDR is not part of Firewall as a Service by default, so it is scoped and contracted separately. Incident response on your endpoints is only in scope once Sophos MDR is contracted. Standard MDR onboarding typically takes two to four weeks and covers discovery, a deployment plan, telemetry validation, MDR onboarding and the incident response runbook. Everything is managed from Sophos Central, the same console FirstNet uses to run your firewall, which keeps policy and visibility in one place. URL: https://www.firstnet.co.za/knowledge/security/can-we-add-mdr-to-our-sophos-firewall/. Reviewed 2026-10-10. #### Can we keep sending and receiving email with Mimecast if Microsoft 365 is down? Yes, if Mimecast email continuity is included in your contracted service. Continuity gives users a failover email experience so they can keep sending and receiving during a Microsoft 365 outage, through Outlook for Windows and Mac, a web interface or mobile apps. How FirstNet prepares for an outage: - Continuity requirements are confirmed in the onboarding technical workshop - FirstNet designs a continuity runbook during onboarding - During an outage, FirstNet supports activation and communication to users - The Resilience and Complete tiers include continuity where it is contracted Continuity is an optional capability, so confirm it is in scope if this matters to your business. FirstNet does not commit to continuity outcomes or outage guarantees beyond the contracted scope. Continuity keeps mail flowing during a provider outage. It does not replace a backup of your mailbox data, which is a separate service. If email downtime has hurt your business before, raise it during discovery so FirstNet can design continuity into the service from the start. URL: https://www.firstnet.co.za/knowledge/security/can-we-keep-sending-and-receiving-email-if-microsoft-365-is-down/. Reviewed 2026-10-10. #### Can we move our self-hosted FortiAnalyzer to FirstNet's managed FAZaaS? Yes. If you run FortiAnalyzer-VM yourself under a Fortinet licence, you can move to FirstNet's FAZaaS instead of renewing. You stop handling patching, backups, capacity planning and upgrades, move from a US dollar licence renewal to a monthly rand service, and gain South African hosting. What changes when you migrate: - Operations: FirstNet runs the dedicated FortiAnalyzer-VM, including patching, upgrades, backups and capacity monitoring - Commercials: a monthly storage bundle in rands, with no Fortinet licence on your invoice - Hosting: FirstNet-operated infrastructure in South Africa - Support: FirstNet's managed-service path instead of you managing the vendor yourself Timing matters: start planning four to six months before your licence renewal so your log history can be transferred cleanly. Before onboarding, FirstNet sizes the bundle from your device count, daily log volume and retention. Some reports need minimum FortiGate firmware versions, and FortiGates split across several FortiCloud accounts should be consolidated first, so FirstNet checks both during onboarding. URL: https://www.firstnet.co.za/knowledge/security/can-we-move-our-self-hosted-fortianalyzer-to-a-managed-service/. Reviewed 2026-10-10. #### Can we see our firewall configuration and logs with FirstNet's managed firewall service? Yes. Read-only visibility is available on request through Sophos Central or a read-only FortiManager ADOM profile. Write access to production is an exception that needs explicit approval, because it changes the managed-service operating model. What visibility looks like: - Sophos: FirstNet runs a handover walkthrough of Sophos Central and provides read-only access where scoped - Fortinet: each customer or business unit has its own ADOM in FortiManager, and a customer read-only admin profile can be provided - Logs: Sophos Standard Protection keeps seven days of logs with basic Central reporting, Xstream adds 30-day cloud reporting, and FortiAnalyzer as a Service provides Fortinet log analytics and compliance reports - Reporting: monthly summaries and change records, plus FortiManager reports on policy revisions and firmware drift Read-only access gives your team and auditors evidence without the risk of untracked changes. Changes still go through FirstNet's approved workflow, so every change stays logged and reversible. If your team needs to share hands-on administration, raise it during contracting so the responsibilities can be agreed before go-live. URL: https://www.firstnet.co.za/knowledge/security/can-we-see-our-firewall-configuration-and-logs/. Reviewed 2026-10-10. #### Can we trial Netskope SSE with FirstNet before we commit? Yes. FirstNet can run a structured Proof of Value (POV) that tests your main Netskope use case with a small group of users in your own environment, against success criteria agreed upfront, so you can make a confident decision and build an internal business case. The POV validates your main use case, confirms fit and shows how Netskope improves visibility, control or user experience. FirstNet needs a few things from you: - A clear use case, such as web security, SaaS and AI control, data protection or VPN replacement - A small test group of users - Success criteria and timing - Agreement on who will review the outcome Example success criteria include seeing cloud app and user activity that was hard to see before, showing that sensitive data is better protected in the test use case, confirming that user access is simpler or safer, and producing reporting that supports your internal decision. The POV is optional. If you go ahead, rollout follows FirstNet's normal sequence: set-up and identity integration, a pilot with a smaller user group, production rollout, then handover and ongoing tuning. URL: https://www.firstnet.co.za/knowledge/security/can-we-test-it-before-we-commit/. Reviewed 2026-10-10. #### Can we use Cloudflare from FirstNet alongside Zscaler or our existing WAF? Yes. Many customers run Zscaler for outbound users and Cloudflare for inbound apps. Where you have an existing WAF, FirstNet plans a phased migration rather than a rip-and-replace. How coexistence usually works: - Zscaler, or another secure service edge, continues to secure staff browsing and SaaS access - Cloudflare protects your public-facing websites, applications and APIs with WAF, DDoS, bot protection and API Shield - An existing WAF stays in place while Cloudflare is onboarded in detection mode and tuned against real traffic - Applications move across in phases, with a documented rollback path until enforcement FirstNet maps your current tools and identifies which contracts Cloudflare could retire over time, since it can consolidate separate WAF, DDoS, CDN, web gateway and VPN services. Consolidation is a choice, not a requirement, and Cloudflare is positioned to fit alongside what already works. A WAF, CDN or VPN renewal is often a good moment to review the approach. Share renewal dates during discovery so the migration plan can line up with them. URL: https://www.firstnet.co.za/knowledge/security/can-we-use-cloudflare-alongside-zscaler-or-our-existing-waf/. Reviewed 2026-10-10. #### Do FortiAnalyzer logs stay in South Africa with FirstNet, and who is responsible under POPIA? Yes. With FirstNet's FortiAnalyzer as a Service (FAZaaS), logs are held on FirstNet-run systems in South Africa and, in normal service, stay there. FirstNet carries the job of running the platform, but under POPIA you remain the responsible party. How the roles split: - FirstNet: runs the hosted platform, including patching, backups, upgrades and capacity monitoring. - You: your duties to data subjects and your internal governance stay the same. - Exceptions: backup locations, support workflows and any other exception paths follow the governing service terms and service description. This applies to FAZaaS only. If you buy FortiAnalyzer Cloud directly from Fortinet, it is typically hosted in US or EU regions. Your compliance review must then take cross-border data into account. If you host FortiAnalyzer yourself, the hosting and the running of it stay with you. For regulated organisations in financial services, the public sector, education and healthcare, three things are often decisive. These are South African hosting, rand billing and a FirstNet-run model. FirstNet reviews formal compliance wording or questionnaires before making any commitment. URL: https://www.firstnet.co.za/knowledge/security/do-fortianalyzer-logs-stay-in-south-africa-and-who-is-responsible-under-popia/. Reviewed 2026-10-10. #### Do we have to replace all our security tools at once to move to Netskope? No. Most organisations start with one urgent use case, such as replacing a web proxy, controlling SaaS and AI tool use, protecting sensitive data or replacing a VPN. Once that use case has proved its value, they expand into adjacent controls on the same platform. Typical expansion paths: - Web gateway refresh, then CASB, remote browser isolation and DLP - Shadow IT or SaaS governance, then SaaS posture management, DLP and AI security - DLP modernisation, then endpoint, email and data posture controls - VPN replacement, then wider SSE adoption and digital experience visibility - Executive reporting needs, then Advanced Analytics and managed reporting Rollouts usually begin with a pilot for a smaller group of users before production, so policies and traffic steering can be tested without disrupting the business. A renewal of an existing product is often a good moment to review what Netskope should replace next. FirstNet plans the move in phases rather than as a rip-and-replace, and can supply, deploy, co-manage or run the platform at each stage. URL: https://www.firstnet.co.za/knowledge/security/do-we-have-to-replace-all-our-security-tools-at-once-to-move-to-netskope/. Reviewed 2026-10-10. #### Does Cloudflare inspect our website and app traffic in South Africa? Yes, for South African users. Cloudflare operates points of presence in Johannesburg and Cape Town, so South African traffic is cached and inspected locally. Specific data residency or POPIA commitments are reviewed against Cloudflare's published data localisation options. What local points of presence mean: - Traffic enters the nearest Cloudflare point of presence, which for South African users is Johannesburg or Cape Town - The same machines filter DDoS, enforce WAF policy, serve cached content and broker Zero Trust access, with no redirect to a separate scrubbing centre - Local cache hits and local security inspection keep latency low for both applications and Zero Trust access Visitors outside South Africa are served by the Cloudflare point of presence nearest to them, as part of its global edge. If your organisation needs contractual residency wording or a specific POPIA inspection scope, FirstNet escalates the request to its product and legal teams and aligns it with Cloudflare's published data localisation options, rather than making informal commitments. Compliance remains a shared responsibility that depends on your configuration and governance. URL: https://www.firstnet.co.za/knowledge/security/does-cloudflare-inspect-our-traffic-in-south-africa/. Reviewed 2026-10-10. #### Does DMARC protect our business against look-alike and typo-squat domains? No. DMARC protects only your real domain, stopping attackers from sending email that uses your exact address. It does not stop criminals registering look-alike or typo-squat domains that resemble yours, because those domains have their own DNS records that you do not control. Look-alike domains need different controls: - FirstNet offers an optional brand-impersonation takedown add-on to SendMarc that detects look-alike domains and phishing infrastructure and runs a takedown workflow - Inbound protection such as Mimecast helps detect look-alike domains in email reaching your staff, with impersonation protection in the Resilience tier and above - Mimecast's Complete tier adds Brand Exploit Protect for advanced brand protection DMARC at p=reject is still essential, because it removes your real domain from the attacker's toolkit. The strongest approach combines enforced DMARC for your own domain, takedown for impersonating domains, and inbound filtering for whatever still arrives. The takedown add-on suits organisations that have been targeted recently or run a recognisable consumer brand. URL: https://www.firstnet.co.za/knowledge/security/does-dmarc-protect-us-against-look-alike-domains/. Reviewed 2026-10-10. #### Does DMARC work with Microsoft 365 and Google Workspace email, and can FirstNet set it up? Yes. DMARC applies to any domain sending email, including mail sent from Microsoft 365 and Google Workspace. For DMARC to be enforced safely, every legitimate sender must pass SPF or DKIM alignment, including Microsoft 365 itself, marketing platforms and finance or ERP systems that send as your domain. FirstNet's managed SendMarc service handles this alignment work before moving your policy to enforcement: - Publishes a monitoring-only DMARC record and collects reports from receiving mail providers - Identifies every sending source, often 15 to 40, including marketing tools, ERP, transactional and bespoke applications - Specifies SPF and DKIM settings for Microsoft 365, Google Workspace and each other platform, which your administrators apply under FirstNet's guidance - Moves the policy from p=none to p=quarantine to p=reject, with go or no-go reviews and rollback guardrails DMARC complements, rather than replaces, inbound email security. FirstNet runs Mimecast in front of Microsoft 365 or Google Workspace to filter phishing reaching your users, while SendMarc stops attackers spoofing your domain to others. Once DMARC is enforced, BIMI can display your logo in Gmail, Apple Mail and Yahoo. URL: https://www.firstnet.co.za/knowledge/security/does-dmarc-work-with-microsoft-365-and-google-workspace-email/. Reviewed 2026-10-10. #### Does FirstNet help with security compliance reports and audit evidence? Yes. FirstNet sets up reports and dashboards that support audits and checks by regulators. Compliance reporting is part of the managed service FirstNet wraps around its Sophos deployments. Reports you can get across FirstNet's security services: - Sophos NG-SIEM: telemetry intake, compliance reports and log retention. The Enhanced and Premium support tiers add more reports and executive reports. - FortiAnalyzer as a Service: built-in compliance reports for Fortinet estates. You can check them against FortiManager policy changes. - FortiManager: monthly reports on policy changes, firmware drift and licence use. - Mimecast: monthly reports on incident trends, policy changes and DMARC progress, depending on scope. - SendMarc: your published DMARC policy, enforcement status and a monthly report as evidence. - Netskope Advanced Analytics: dashboards, KPI reports and visuals ready for the board. These reports give auditors and boards evidence that controls are in place and working. They support your compliance goals but do not guarantee them. Compliance is shared, and it depends on your own settings and governance. FirstNet's product and legal teams review formal security questionnaires and audit evidence packs. They review contract wording too. None of these are signed informally. URL: https://www.firstnet.co.za/knowledge/security/do-you-help-with-compliance-reports/. Reviewed 2026-10-10. #### Does FirstNet operate its own security operations centre (SOC)? No. FirstNet does not run its own SOC (security operations centre). Sophos MDR delivers the 24/7 SOC layer, including threat hunting and analyst-led detection, and FirstNet's Incident Response team acts on its alerts with you. The model has two arms. It works like this: - Sophos MDR analysts watch your environment, hunt for threats and send an alert when they spot suspicious activity. - FirstNet's support desk receives the alert. - FirstNet's Incident Response team then works with you to contain the threat, fix the cause and recover. - An incident response runbook, agreed at onboarding, sets out how alerts arrive, who steps in and which remediation playbook applies. Around this, FirstNet handles onboarding, setup, customer success, compliance reporting and escalation for every Sophos deployment. Higher support tiers add expanded incident response. The Premium tier includes on-site remediation support where it applies. FirstNet is a Sophos MSP and Titanium Partner. Titanium is the top tier of the Sophos Partner Program, and it gives FirstNet direct escalation paths into Sophos. URL: https://www.firstnet.co.za/knowledge/security/does-firstnet-operate-its-own-soc/. Reviewed 2026-10-10. #### Does FirstNet resell security licences, or does it run the security service for you? FirstNet runs the service. It deploys each security platform, sets and tunes policies, monitors it and handles changes through its Rapid Response support desk. Where a customer specifically needs hardware or licences only, FirstNet can supply them, but that is quoted separately from its managed services. What running the service means in practice: - One contract, one support desk and one team accountable for outcomes - Policy tuning is ongoing, not a one-off setup task - FirstNet escalates directly into Sophos, Mimecast, Fortinet, Cloudflare and Netskope, so you do not manage vendor support queues - You keep ownership of your data and configurations Some services offer a choice of operating model. With Netskope, for example, you can buy licensing only, have FirstNet deploy and hand over, co-manage the platform with FirstNet, or have FirstNet run it as a full managed service, with the split of responsibilities agreed upfront. FortiGate hardware and Fortinet licences can also be bought separately, but that is not FirstNet's Firewall as a Service. If you are unsure which model suits your team, a FirstNet specialist can compare the options with you. URL: https://www.firstnet.co.za/knowledge/security/do-you-resell-security-licences-or-run-the-service/. Reviewed 2026-10-10. #### Does FirstNet's FortiAnalyzer as a Service replace our SIEM? No. FortiAnalyzer is the Fortinet-native analytics and reporting layer, sitting closer to your FortiGates and providing out-of-the-box compliance reports. If you already use Splunk or Sentinel, keep it; FirstNet can scope log forwarding to your SIEM separately. How the work divides: - FortiAnalyzer as a Service: centralised log analytics, threat correlation, incident investigation and compliance reporting across your Fortinet devices - Your SIEM: correlation across all your security and IT sources, not only Fortinet - FortiManager, if FirstNet runs it too: policy revisions are cross-referenced in FortiAnalyzer reports, giving a change-and-evidence trail for audits Neither FortiAnalyzer nor FortiManager is a SOC. For 24/7 analyst-led detection, FirstNet offers Sophos MDR with its own Incident Response team, and Sophos NG-SIEM is an option if you want to replace a legacy SIEM as part of a planned transformation. If you do not have a SIEM, FortiAnalyzer as a Service may cover your Fortinet logging and reporting needs on its own, provided the storage bundle is sized for your log volume and retention period. URL: https://www.firstnet.co.za/knowledge/security/does-fortianalyzer-replace-our-siem/. Reviewed 2026-10-10. #### Does FirstNet's managed cybersecurity cover cloud and hybrid environments? Yes. FirstNet's managed cybersecurity protects on-premises, cloud and hybrid environments with consistent visibility and control, so cloud workloads and SaaS users are not treated as a separate security problem. How cloud is covered depends on the services in your contract: - Sophos XDR and MDR connect to Microsoft 365, Azure, AWS and Google Workspace for identity and cloud telemetry - A cloud access security broker (CASB) from Netskope or Cloudflare finds risky sharing, misconfigurations and unsanctioned SaaS and AI apps - Fortinet Hosted VDOM firewalls can act as the firewall layer for FirstNet Private Cloud workloads and connected sites - Cloudflare protects public-facing apps and APIs with WAF, DDoS and bot protection at the edge - Mimecast sits in front of Microsoft 365 or Google Workspace email Cloud security is scoped like every other layer: FirstNet confirms which platforms, tenants and workloads are in scope during discovery. Compliance remains a shared responsibility that depends on your configuration and governance. A FirstNet security architect can map your cloud estate to the right controls. URL: https://www.firstnet.co.za/knowledge/security/is-cloud-security-included/. Reviewed 2026-10-10. #### Does FirstNet's managed cybersecurity protect remote and hybrid workers? Yes. FirstNet's managed security controls follow users wherever they work, so staff at home, in branches or on the road get the same protection as those at head office, without relying on a traditional network perimeter. Several services cover the hybrid workforce: - Endpoint protection: Sophos protects laptops, servers and mobile devices with malware protection, endpoint detection and response, and rapid containment of compromised devices - Secure web and SaaS access: Netskope or Cloudflare Gateway inspects internet and cloud app traffic for office, remote and contract users - Private app access: Netskope Private Access or Cloudflare Access gives app-level zero trust access instead of a legacy VPN - Email: Mimecast filters phishing and impersonation before mail reaches any device Cloudflare's edge, which includes Johannesburg and Cape Town, lets remote staff and contractors reach applications without backhauling traffic to head office. Sophos MDR monitors around the clock, and FirstNet's Incident Response team acts on its alerts. Most organisations start with the gap that hurts most, such as an overloaded VPN, and add layers over time on the same FirstNet contract. URL: https://www.firstnet.co.za/knowledge/security/does-managed-cybersecurity-support-remote-and-hybrid-workforces/. Reviewed 2026-10-10. #### Does FirstNet's managed security help meet cyber-insurance requirements? Yes, it helps. Sophos MDR, XDR, NG-SIEM and Secure AI map to the controls most cyber insurers ask for, and FirstNet provides audit-grade reporting to evidence them. Compliance and insurance outcomes remain a shared responsibility. Controls that insurers commonly ask about, and the FirstNet services that address them: - 24/7 monitoring and response: Sophos MDR with FirstNet Incident Response - Log retention and reporting: Sophos NG-SIEM or FortiAnalyzer as a Service - Email authentication: SendMarc takes DMARC to p=reject, which insurers increasingly ask about - Recovery: Druva backup paired with MDR for ransomware recovery - Application protection: Cloudflare WAF, DDoS protection and DLP controls for public-facing apps and data FirstNet can align the services to your insurer's control list, but it cannot promise a policy outcome. Insurer questionnaires that need formal answers or signed wording are reviewed by FirstNet's product and legal teams. Bring your latest insurer questionnaire to discovery so FirstNet can show which controls you already have and where the gaps are. URL: https://www.firstnet.co.za/knowledge/security/does-this-help-with-cyber-insurance-requirements/. Reviewed 2026-10-10. #### Does Netskope guarantee compliance with POPIA or other regulations? No solution guarantees compliance on its own. Netskope, delivered by FirstNet, strengthens control, visibility and reporting, which supports your compliance goals, but outcomes depend on your setup, governance and operation. How Netskope supports compliance work: - Controls who can access which applications and data - Shows and manages how cloud apps, including AI tools, are used - Protects sensitive data, such as POPIA personal information, with DLP across web, SaaS, endpoint, email and AI channels - Gives safer access to private applications through zero trust Private Access - Reduces browsing risk with the secure web gateway and remote browser isolation - Improves reporting and audit visibility through Advanced Analytics Security and compliance remain a shared responsibility between FirstNet and your organisation. FirstNet and Netskope help improve control, visibility and evidence, but your policies, data classification and governance decide the outcome. If you need formal compliance wording, a control mapping or a completed security questionnaire, FirstNet escalates the request for formal review rather than giving informal assurances. URL: https://www.firstnet.co.za/knowledge/security/does-netskope-guarantee-compliance/. Reviewed 2026-10-10. #### How are email archives protected in FirstNet's managed Mimecast service? Email archives in FirstNet's managed Mimecast service are encrypted, and access is controlled by roles and audit trails, so only authorised people can search or export archived mail and their activity is recorded. Archiving is an optional capability, added where you contract it: - Retention periods of 30 days, 1 year, 7 years or 99 years - Every inbound and outbound message captured under enforced retention, indexed for eDiscovery and legal hold - FirstNet helps configure retention, guides legal hold and search or export workflows, and supports day-to-day use - The Complete tier includes a 99-year archive option for regulated or high-risk organisations Your organisation remains the owner of the archived data and makes the final decisions on retention and governance, while FirstNet operates the Mimecast layer and advises. Mimecast supports South African data residency preferences, and specific contractual residency wording is reviewed by FirstNet's product and legal teams. An archive is not a backup. It preserves messages for compliance and investigations, while a backup restores lost mailboxes, so many regulated organisations need both. Large legacy archive migrations are scoped as a separate project after a technical workshop. URL: https://www.firstnet.co.za/knowledge/security/how-are-archives-protected/. Reviewed 2026-10-10. #### How can FirstNet show us every system that is sending email using our domain? A baseline DMARC report shows every system sending email as your domain. FirstNet publishes a monitoring-only DMARC record (or uses your existing one) and collects the reports that receiving mail providers send back, usually over two reporting cycles. How the discovery works: - Aggregate (RUA) reports from receiving mail providers list pass and fail results for each sending source - Forensic (RUF) reports, where providers send them, give samples of failed messages and reveal specific impersonation attempts - The SendMarc platform turns these reports into one inventory of sending IP addresses, platforms and alignment status - Each source is classified as legitimate, a forwarder or unauthorised, and shared with your business owners Most organisations discover far more senders than expected, often 15 to 40 sources including marketing platforms, ERP and finance systems, and some they do not recognise. Legacy domains and domains from acquisitions often still send mail too. A monitoring-only record does not block or change any mail, so discovery carries no delivery risk. The inventory then becomes the plan for authenticating legitimate senders before FirstNet moves your policy towards enforcement. URL: https://www.firstnet.co.za/knowledge/security/how-can-we-find-out-who-is-sending-email-using-our-domain/. Reviewed 2026-10-10. #### How can FirstNet stop sensitive data leaving through Microsoft 365, email and AI tools? Data loss prevention (DLP) controls detect and block sensitive information, such as personal information covered by POPIA, payment data or credentials, as it moves through web, SaaS, email, endpoints and AI interactions. Netskope DLP, delivered by FirstNet, applies these controls from one policy engine, including prompts sent to AI tools. How a DLP rollout typically runs: - Discovery: which data matters most, where it lives and which channels it leaves through - Policy design for the first use case, such as SaaS uploads or AI prompts - A pilot with a smaller group of users before production - Tuning after go-live to balance protection with usability - Reporting on DLP alerts, either reviewed by FirstNet or sent to your SIEM Within Microsoft 365, FirstNet can also apply sensitivity labels, encryption and retention as part of its Microsoft 365 security work. DLP supports your compliance goals but does not guarantee compliance on its own; outcomes depend on your setup, governance and operation. Many organisations start with one high-risk channel and extend DLP to endpoint and email once the first policies are proven. URL: https://www.firstnet.co.za/knowledge/security/how-do-we-stop-sensitive-data-leaving-the-business-through-microsoft-365-email-a/. Reviewed 2026-10-10. #### How can we see risky sharing and unsanctioned apps in Microsoft 365 with FirstNet? A cloud access security broker (CASB) gives visibility into how your Microsoft 365 or Google Workspace estate is being used. It can scan for misconfigurations, public file shares, risky OAuth grants and third-party app sprawl, and show which SaaS and AI tools staff are using. FirstNet delivers CASB through Netskope or Cloudflare. What FirstNet does with the findings: - Reviews them with you on a regular cadence - Helps you work through remediation, such as closing public shares or removing risky app permissions - Adds data loss prevention where needed to control egress of POPIA personal information - Reports through dashboards suited to administrators and leadership Which platform fits depends on your wider plans. Netskope's CASB sits on the same platform as its secure web gateway, DLP and Private Access. Cloudflare's CASB sits alongside Cloudflare Zero Trust and its application protection. FirstNet's Microsoft 365 security work also covers identity controls such as MFA and conditional access, sensitivity labels, retention and audit trails. A Microsoft 365 security assessment is a practical starting point: a tenant review, gap analysis and prioritised action plan. URL: https://www.firstnet.co.za/knowledge/security/how-can-we-see-risky-sharing-and-unsanctioned-apps-in-microsoft-365/. Reviewed 2026-10-10. #### How do FirstNet's managed cybersecurity services reduce business risk? Managed cybersecurity reduces business risk by combining preventive controls, continuous monitoring and rapid response, which lowers both the likelihood and the impact of ransomware, phishing, data breaches and unauthorised access. FirstNet delivers this as layered services that work together. Prevention comes from controls such as managed firewalls, Mimecast email filtering, DMARC enforcement through SendMarc, and zero trust access that limits users to the applications they need. Detection comes from Sophos MDR, whose analysts monitor, hunt for threats and alert around the clock. Response comes from FirstNet's Incident Response team, which works with you to contain the threat, remediate and recover, following a runbook agreed during onboarding. Recovery matters too. FirstNet pairs Sophos MDR with Druva backup, so you have an independent copy of data to restore if files are encrypted. The business case rests on avoiding what an incident costs: extended downtime, data recovery and system rebuilds, legal, regulatory and contractual exposure, and long-term reputational damage. Managed services turn security spend into a predictable cost focused on risk reduction. FirstNet's security risk assessments can show where your biggest exposure sits today. URL: https://www.firstnet.co.za/knowledge/security/how-do-managed-cybersecurity-services-reduce-business-risk/. Reviewed 2026-10-10. #### How do FirstNet's security services fit together into a layered defence? FirstNet's security services each cover a different part of the attack surface, so most organisations combine several. Every layer runs as a managed service under one FirstNet contract, with one support desk. The layers are: - Network edge: Firewall as a Service on Fortinet or Sophos, on your site or hosted by FirstNet, with FortiManager and FortiAnalyzer for Fortinet estates - Inbound email: Mimecast filters phishing, malware and impersonation before delivery - Outbound email: SendMarc enforces DMARC so nobody can spoof your domain - Endpoint and SOC: Sophos endpoint protection with Sophos MDR detects threats around the clock - Incident response: FirstNet's team remediates when Sophos MDR raises an alert - Secure access: Netskope or Cloudflare Zero Trust secures web, SaaS and private app access and replaces legacy VPN - Public apps: Cloudflare WAF, DDoS and bot protection at the edge The layers reinforce each other. A Sophos firewall and Sophos endpoints share health status through Synchronized Security, and FortiManager with FortiAnalyzer gives a change-and-evidence trail for audits. Most customers start with the layer that matches their most urgent risk, then add the others over time. URL: https://www.firstnet.co.za/knowledge/security/how-do-firstnets-security-services-fit-together/. Reviewed 2026-10-10. #### How do FortiManager and FortiAnalyzer work together in FirstNet's Fortinet service? In FirstNet's Fortinet service, FortiManager sets up your devices and FortiAnalyzer analyses what they see. With FirstNet running both, devices register once, logs flow automatically, and you can match FortiAnalyzer reports to FortiManager policy changes. The two products are built as a pair. Here is how the three Fortinet layers fit: - FortiGate and the wider fabric (FortiSwitch, FortiAP, FortiExtender, FortiSandbox): enforce policy and inspect traffic. - FortiManager: plans and pushes changes, with install previews, revisions and one-click rollback. - FortiAnalyzer, delivered as a service (FAZaaS): captures logs and evidence for analytics and compliance reports. This closes the loop between planned changes and proof of what happened. That helps in audits: you can show when a policy changed and how traffic behaved after it. Neither product replaces the other, and neither is a SIEM or a SOC. For 24/7 detection, FirstNet offers Sophos MDR with its Incident Response team. By default, FirstNet runs both on its South African platform, under one managed-service contract. URL: https://www.firstnet.co.za/knowledge/security/how-do-fortimanager-and-fortianalyzer-work-together/. Reviewed 2026-10-10. #### How does Cloudflare, managed by FirstNet, stop bad bots and protect APIs? Cloudflare Bot Management uses machine-learning bot scoring, JavaScript challenges and mobile signals to stop automated abuse such as credential stuffing, scraping, inventory hoarding and fake sign-ups. API Shield protects APIs with schema validation, mutual TLS, JWT validation, sequence analytics and abuse detection, covering risks a traditional web application firewall can miss. What each control does: - Bot scoring rates how likely each request is to be automated, so policies can challenge or block suspect traffic while letting real users through - Challenges test suspicious clients before they reach your application - Schema validation rejects API calls that do not match the expected structure - Mutual TLS and JWT validation confirm that API clients are who they claim to be - Sequence analytics spots abnormal patterns of API calls that point to abuse Both run on the same platform as Cloudflare's WAF and DDoS protection, with one dashboard, and FirstNet tunes the policies as part of the managed service. Bot Management suits retail and e-commerce sites facing credential stuffing or inventory hoarding, while API Shield suits organisations whose application surface has shifted towards APIs that the WAF no longer fully covers. URL: https://www.firstnet.co.za/knowledge/security/how-does-cloudflare-stop-bots-and-protect-apis/. Reviewed 2026-10-10. #### How does FirstNet handle changes to our managed firewall? Firewall changes follow approved workflows with testing and rollback plans to keep your network stable. Only your authorised technical contacts can request and approve changes, and FirstNet implements them through its Rapid Response service process. How changes are controlled: - Standard moves, adds and changes within the agreed policy framework are handled as part of the managed service - Emergency, after-hours and major design changes, such as new VPNs, SD-WAN topology changes or large policy refactors, need explicit approval and may be scoped separately - On Fortinet estates run through FortiManager, every policy install needs an install preview, peer review and a documented rollback step, with one-click rollback to a known-good configuration - Rollouts can be staged and scheduled across sites - On Sophos, all changes are logged and audit-traceable through Sophos Central audit logs FirstNet also keeps change records and monthly summaries, and FortiManager reports policy revisions and firmware drift so the estate stays aligned. Large redesigns, migrations and security audits are scoped as projects outside the standard managed service, so confirm your expected change volume when you contract. URL: https://www.firstnet.co.za/knowledge/security/how-are-changed-handled/. Reviewed 2026-10-10. #### How does FirstNet help secure staff use of AI tools like Copilot and ChatGPT? FirstNet uses Sophos Secure AI to give you visibility of shadow AI use, policy and role-based controls with prompt monitoring, and protection through input sanitisation, output interception and AI data loss prevention, with AI risk monitored by Sophos MDR. Sophos Secure AI is built on three pillars: - Visibility: shadow AI discovery, an AI usage dashboard and multi-layer detection - Control: granular access, global policy, role-based controls and prompt monitoring - Protection: input sanitisation, output interception, AI data loss prevention and 24/7 MDR-managed AI risk A Secure AI rollout typically takes two to six weeks, depending on how many AI tools and users are in scope. FirstNet also offers AI controls through Netskope, whose CASB identifies AI app usage and whose DLP can stop sensitive data, such as POPIA personal information, being exposed in prompts. Which platform fits depends on whether you already run Sophos or are building a secure access stack. These controls let you set rules for AI use rather than relying on an outright ban. A sensible first step is mapping which AI tools your staff already use. URL: https://www.firstnet.co.za/knowledge/security/how-do-you-help-with-ai-tools-like-copilot-and-chatgpt/. Reviewed 2026-10-10. #### How does FirstNet size a firewall correctly? A firewall should be sized on your real peak inspected traffic, not on your internet line speed. FirstNet gathers sizing inputs during discovery before recommending a model or hosted option, because enabled security features and SSL inspection change the answer most. What FirstNet looks at: - Users: total, peak concurrent and remote VPN users - Devices: endpoints, BYOD, IoT and servers, since devices drive sessions and traffic - Peak throughput: internet, inter-site and encrypted traffic that will be inspected - Security features: IPS, application control, antivirus, web and DNS filtering, sandboxing - SSL/TLS inspection: often the biggest sizing factor, treated separately from basic firewall throughput - VPN tunnels, concurrent sessions, new sessions per second, interfaces, HA, the firewall's role and growth over the next 12 to 36 months These inputs are then matched against datasheet metrics such as threat protection throughput, SSL inspection throughput and IPsec VPN throughput. FirstNet documents whether the recommendation assumes basic firewalling, NGFW services or full threat protection with SSL inspection, which prevents under-sizing once advanced inspection is switched on. URL: https://www.firstnet.co.za/knowledge/security/how-do-you-size-a-firewall-correctly/. Reviewed 2026-10-10. #### How does FirstNet use MFA and conditional access to stop Microsoft 365 account takeovers? FirstNet hardens Microsoft 365 sign-in with multi-factor authentication (MFA), conditional access and privileged identity management as part of its Microsoft 365 security and compliance service. For a finance-sector client, conditional access and MFA adoption reduced account takeovers. Weak identity controls are a root cause of many breaches. In general terms, each control does a different job: - MFA asks for a second proof of identity, so a stolen password alone is not enough to sign in - Conditional access checks conditions such as the user, device, location or sign-in risk before granting access - Privileged identity management limits standing administrator rights, reducing what a compromised admin account can do How the rollout is handled matters as much as the policies. FirstNet sets policy baselines, rolls changes out in stages under change control and communicates each phase clearly, prioritising controls that add protection with minimal friction for users. Dashboards then track incidents, drift and user risk signals, and admin and end-user training helps the changes stick. Conditional access and privileged identity management depend on your Microsoft Entra ID licence level. FirstNet is a Microsoft Cloud Solution Provider and can supply Entra security add-ons if your current licences fall short. URL: https://www.firstnet.co.za/knowledge/security/how-does-firstnet-use-mfa-and-conditional-access-to-stop-microsoft-365-account/. Reviewed 2026-10-11. #### How does FortiManager reduce the risk of firewall changes in FirstNet's managed service? FortiManager lets changes be validated before they reach your firewalls. FirstNet uses install previews, policy package validation, ADOM and device revisions, and one-click rollback to a known-good configuration, and its change process requires an install preview, peer review and a documented rollback step for every policy install. The controls in practice: - Policy packages: firewall, NAT and security policies built once, validated, then installed to one or many devices - Shared object database: change an address or service once, rather than editing each firewall by hand - Workspace mode and approval workflows: changes are isolated and approved before installation, which suits regulated estates - Staged, scheduled rollouts across sites - Firmware drift reports, with a quarterly firmware programme to keep the estate aligned Each customer or business unit has its own ADOM, so a change in one estate cannot spill into another. When FortiAnalyzer as a Service is also in place, reports can be cross-referenced against policy revisions, giving auditors evidence of what changed and what happened afterwards. URL: https://www.firstnet.co.za/knowledge/security/how-does-fortimanager-reduce-the-risk-of-firewall-changes/. Reviewed 2026-10-10. #### How does Netskope compare with Zscaler for secure access and data protection? Both are strong cloud security platforms. Netskope is usually the better fit when your priorities are SaaS visibility, data protection, control over AI tool use, and a single platform with one policy model and one console. Zscaler is well known for zero trust access and web security at large scale. Points to compare against your own requirements: - Platform model: Netskope positions one platform, one policy model and one console, while Zscaler positions its Zero Trust Exchange and large-scale cloud security model - Data and SaaS: Netskope is often strongest on SaaS visibility, DLP and AI-aware controls - VPN replacement: both offer zero trust private access, and Netskope includes Private Access within the same platform - Network and user experience: Netskope uses its NewEdge backbone, while Zscaler emphasises the scale of its cloud network The right choice depends on your main use case, users and existing tools, so FirstNet recommends comparing them against your own requirements rather than on general claims. A Netskope Proof of Value lets you test your main use case in your own environment. FirstNet sells, deploys and optionally manages Netskope. URL: https://www.firstnet.co.za/knowledge/security/how-does-netskope-compare-with-zscaler/. Reviewed 2026-10-10. #### How long are Sophos firewall logs kept in FirstNet's managed firewall service? With Standard Protection, logs are kept on the firewall for seven days with basic reporting in Sophos Central. Xstream Protection adds Central Firewall Reporting Advanced, with 30-day cloud log retention and multi-firewall reporting. If you need logs for longer: - Sophos MDR: logs can be retained in the Sophos MDR data lake, alongside 24/7 detection and response - Your SIEM: logs can be forwarded via syslog to a SIEM you manage - Sophos NG-SIEM: available for compliance reporting and longer log retention at enterprise scale All firewalls, on site or hosted by FirstNet, log to Sophos Central, and all changes are audit-traceable through Sophos Central audit logs. Retention requirements often come from auditors, regulators or cyber insurers, so check what period you need to evidence before choosing a bundle or retention option. The retention approach and any integration are confirmed during the design phase, so they can be built into the service from day one rather than added after an audit finding. URL: https://www.firstnet.co.za/knowledge/security/how-long-are-sophos-firewall-logs-kept/. Reviewed 2026-10-10. #### How long does it take FirstNet to onboard Sophos managed detection and response (MDR)? Standard Sophos MDR onboarding with FirstNet typically takes two to four weeks. Integrating XDR or next-generation SIEM telemetry usually takes four to eight weeks, depending on how many data sources are connected, and a full next-generation SIEM transformation that replaces a legacy SIEM typically takes eight to 16 weeks. Onboarding follows six steps: - Discovery and architecture review - A deployment plan agreed with you - Telemetry sources validated and provisioned - Sophos MDR onboarding and escalation runbook handover - FirstNet's incident response runbook agreed: how notifications are received, who mobilises and the remediation playbook - Handover to FirstNet's managed-services team The timeline depends mostly on telemetry breadth: how many endpoints, firewalls, identity providers and cloud platforms such as Microsoft 365, Azure, AWS and Google Workspace are connected. Existing Microsoft Defender telemetry can be ingested rather than replaced. If you also want Sophos Secure AI for AI governance, that rollout typically takes two to six weeks, depending on how many AI tools are in scope. URL: https://www.firstnet.co.za/knowledge/security/how-long-does-it-take-to-onboard-managed-detection-and-response/. Reviewed 2026-10-10. #### How long does it take to reach DMARC p=reject with FirstNet's managed SendMarc service? There is no fixed timeline: it is driven by how many sending sources you have and how quickly your platform owners make authentication changes. FirstNet scopes the journey during discovery rather than committing to a date upfront. The steps that drive the timeline: - Discovery of your primary, secondary and legacy domains, and the business owners of each sending platform - A baseline DMARC report, which typically lands within two reporting cycles of publishing a monitoring record - Source classification, which often reveals 15 to 40 sending sources - SPF and DKIM remediation, platform by platform, with your administrators making changes under FirstNet's guidance - The move to p=quarantine, then p=reject, with each step gated on a go or no-go review The remediation stage usually takes longest, because each marketing platform, ERP or bespoke application owner has to make and test changes. Organisations that bring those owners in early move faster, while extra domains found during discovery, or acquisitions, add to the scope. After p=reject, steady-state operation continues with monthly reviews, authentication of new sources and optional BIMI deployment. URL: https://www.firstnet.co.za/knowledge/security/how-long-does-it-take-to-reach-p-reject/. Reviewed 2026-10-11. #### How much FortiAnalyzer storage do we need with FirstNet's FAZaaS? FAZaaS is sold in storage bundles starting at 50 GB and increasing in 50 GB steps. As a rule of thumb, 100 GB holds about 90 days of logs at 1 GB per day, measured before compression. FirstNet sizes the bundle from your device count, daily log volume and retention needs. Typical starting points: - 50 GB: one to three FortiGates at a single site, with little SSL inspection - 100 GB: three to eight FortiGates with light SSL inspection - 150 GB: eight to 15 mixed Fortinet devices with moderate SSL inspection - 200 GB: 15 to 25 devices with active SSL inspection - 250 GB and up: 25 or more devices, or retention beyond 90 days FirstNet sizes on raw rather than compressed volume to leave headroom. It recommends sizing up if your estate is still growing, your compliance retention exceeds 90 days, a regulated audit is pending, or full SSL deep inspection is enabled across most policies. If your needs change, the bundle can be stepped up, and FirstNet alerts you before you reach the ceiling. URL: https://www.firstnet.co.za/knowledge/security/how-much-fortianalyzer-storage-do-we-need/. Reviewed 2026-10-10. #### How much work does our IT team need to do for a FirstNet DMARC project? Less than a do-it-yourself project, but some. FirstNet engineers identify every sending source and specify the SPF and DKIM changes needed, your administrators make those DNS and platform changes under FirstNet's guidance, and FirstNet validates them. The split of work: - FirstNet: domain discovery, DMARC record management, report analysis, source classification, change specifications, enforcement steps, BIMI set-up and monthly reviews - Your team: making DNS changes and configuring each sending platform, such as Microsoft 365, Google Workspace, marketing tools, ERP and bespoke applications - Jointly: go or no-go reviews before each move from p=none to p=quarantine to p=reject The DMARC platform is the easy part. The source authentication work across many systems is what stalls most do-it-yourself projects, and that is where FirstNet's engineers carry the load. Progress through each enforcement step depends on how quickly your platform owners complete their changes, so having them engaged early keeps the project moving. If work slows, the monthly managed-service review keeps outstanding items visible. URL: https://www.firstnet.co.za/knowledge/security/how-much-work-does-our-it-team-need-to-do-for-a-dmarc-project/. Reviewed 2026-10-10. #### Is Cloudflare a SOC or managed detection and response (MDR) service? No. Cloudflare is a security platform, not a 24/7 security operations centre. For managed detection and response, FirstNet offers Sophos MDR with FirstNet Incident Response. How the two fit together: - Cloudflare protects public apps, APIs, networks and remote users at the edge with WAF, DDoS, bot management and Zero Trust controls - FirstNet tunes Cloudflare policies, triages false positives and reviews attack events as part of its managed wrap - Cloudflare logs can be forwarded into your SIEM or into FirstNet's monitoring - Sophos MDR analysts monitor, hunt and alert around the clock across endpoints, firewalls, identity, cloud and email - When Sophos raises an alert, FirstNet's Incident Response team works with you to contain, remediate and recover Cloudflare does not include a full SIEM or an MDR-style 24/7 SOC, so if you need analyst-led detection around the clock, plan Sophos MDR or your own SOC alongside it. Support for both runs through FirstNet's Rapid Response desk as a single entry point, with escalation into Cloudflare or Sophos as needed. URL: https://www.firstnet.co.za/knowledge/security/is-cloudflare-a-soc-or-mdr-service/. Reviewed 2026-10-10. #### Is Cloudflare just a CDN, or a full security platform? Cloudflare started as a CDN, but today it covers application security, Zero Trust access, network services and edge compute on one platform, and often replaces three or four separate security and delivery contracts. FirstNet designs, deploys and tunes it for South African organisations. The four product families: - Application services: web application firewall (WAF), DDoS protection, Bot Management, API Shield, CDN and Argo Smart Routing - Zero Trust: Cloudflare Access for zero trust network access, Cloudflare Gateway for secure web access, Browser Isolation, CASB and DLP - Network services: Magic Transit for DDoS protection of whole IP ranges, Magic WAN and Magic Firewall - Developer platform: Workers, R2 storage and D1 for running code at the edge Every Cloudflare point of presence runs every service, including in Johannesburg and Cape Town. The same edge filters DDoS, enforces WAF policy, serves cached content and brokers Zero Trust access, so there are no appliances to deploy and no separate scrubbing-centre redirect. FirstNet adds the managed wrap: design, policy hardening, ongoing tuning, SIEM integration and partner-tier escalation into Cloudflare. URL: https://www.firstnet.co.za/knowledge/security/isnt-cloudflare-just-a-cdn/. Reviewed 2026-10-10. #### Is FirstNet's FortiAnalyzer as a Service the same as Fortinet's FortiAnalyzer Cloud? No. FortiAnalyzer Cloud is Fortinet's own service, typically hosted in US or EU regions and billed in US dollars. FirstNet's FortiAnalyzer as a Service (FAZaaS) is hosted in South Africa, billed in rands and operated by FirstNet, so log data stays in South Africa during normal operation. How the options compare: - FAZaaS: a dedicated FortiAnalyzer-VM on FirstNet-operated infrastructure in South Africa, as a monthly rand service based on a storage bundle, with FirstNet handling patching, upgrades, backups and capacity monitoring - FortiAnalyzer Cloud: hosted offshore by Fortinet, an annual US dollar subscription, with Fortinet as the support path - Self-hosted FortiAnalyzer-VM or appliance: you run the platform yourself under a Fortinet licence All routes use the same FortiAnalyzer engine, so the analytics are comparable. The difference is hosting location, currency and who operates it. This matters for POPIA planning. With FAZaaS your organisation remains the responsible party, but logs are not routinely hosted offshore. If you buy FortiAnalyzer Cloud directly, your compliance assessment must account for cross-border data. URL: https://www.firstnet.co.za/knowledge/security/is-fortianalyzer-as-a-service-the-same-as-fortianalyzer-cloud/. Reviewed 2026-10-10. #### Is Microsoft 365 secure out of the box, or does it need extra hardening from FirstNet? Not on its own. Microsoft 365 includes strong identity, security and data-governance features, but they protect you only once they are configured for your risks, and some depend on your licence level. FirstNet's Microsoft 365 security and compliance service adds that configuration, plus monitoring and independent layers where they are needed. Misconfigurations and weak identity controls are the root cause of many breaches, and regulations add pressure for data governance, retention and auditability. A tenant needs guardrails that balance productivity with protection, which is the focus of FirstNet's hardening work across identity, devices, applications and data. Beyond tuning Microsoft's own controls, FirstNet can add independent layers: - Mimecast in front of Microsoft 365, with separate threat intelligence, sandboxing and URL rewriting, and optional email continuity if Microsoft 365 itself is down - Sophos MDR, which can ingest Microsoft Defender telemetry, so you keep Defender and add analyst-led detection around the clock - Druva backup for Exchange, OneDrive, SharePoint and Teams, because retention is not backup when files are deleted or ransomware encrypts synced data A Microsoft 365 security assessment, made up of a tenant review, gap analysis and prioritised action plan, shows where your tenant stands and which fixes to tackle first. URL: https://www.firstnet.co.za/knowledge/security/is-microsoft-365-secure-out-of-the-box-or-does-it-need-extra-hardening-from/. Reviewed 2026-10-11. #### Is Mimecast email archiving the same as a Microsoft 365 backup? No. An email archive captures every inbound and outbound message under enforced retention, indexed for eDiscovery and legal hold. A backup is a point-in-time copy for restoring lost mailboxes or data. Most regulated organisations need both, and FirstNet offers each as a separate service. The difference in practice: - Archive: answers "show me every email about this matter from the last seven years" for audits, investigations and legal hold - Backup: answers "restore the mailbox or files that were deleted or encrypted yesterday" - FirstNet's Mimecast archiving offers retention of 30 days, 1 year, 7 years or 99 years, where contracted - Druva, delivered by FirstNet, backs up Exchange, OneDrive, SharePoint and Teams with unlimited storage Microsoft 365 retention settings are not a backup either. If someone deletes something important, or ransomware encrypts synced files, you need an independent copy to restore from. FirstNet helps configure archive retention and legal hold workflows, while your organisation decides how long data must be kept. A FirstNet specialist can check whether both your retention and your recovery needs are covered. URL: https://www.firstnet.co.za/knowledge/security/is-email-archiving-the-same-as-backup/. Reviewed 2026-10-10. #### Is Netskope from FirstNet just a web proxy replacement? No. A secure web gateway is often the entry point, but Netskope also covers CASB, DLP, Private Access, remote browser isolation, analytics and wider SSE and SASE capabilities on the same platform, delivered and optionally managed by FirstNet. What the Netskope One platform includes: - Secure Web Gateway (SWG): secures internet and SaaS traffic inline - Cloud Access Security Broker (CASB): visibility and control of cloud apps, including shadow IT and AI tool usage - Data Loss Prevention (DLP): protects sensitive data across web, SaaS, endpoint, email and AI channels - Private Access (ZTNA): zero trust, app-level access to private applications in place of a VPN - Remote Browser Isolation (RBI): opens risky web content in an isolated session - Advanced Analytics: dashboards, KPI reporting and board-ready visuals All of these share one console, one client and one policy engine, with traffic carried over NewEdge, Netskope's private cloud backbone. That shared architecture means policy logic and visibility do not have to be rebuilt separately for each control. A common path is to replace an ageing proxy first, then add CASB, remote browser isolation and DLP once the gateway is proving its value. URL: https://www.firstnet.co.za/knowledge/security/is-netskope-just-a-web-proxy-replacement/. Reviewed 2026-10-10. #### Is a managed service included by default when we buy Netskope from FirstNet? No. Managed and co-managed services are optional and scoped clearly. You can buy licensing only, deployment support, co-management or a full managed service from FirstNet, and the split of responsibilities is agreed upfront so ownership is clear after go-live. The four service options: - Supply: FirstNet supplies Netskope licensing for the agreed use case, and your team or partner runs it - Deploy: FirstNet designs and sets up the platform, then hands it over to your team - Co-manage: FirstNet and your team share policy tuning, alert review and reporting - Managed service: FirstNet runs the platform on an ongoing basis within an agreed scope and reporting cadence Whichever you choose, production handover includes documented policy scope, administrative ownership, logging and reporting set-up, support channels and any open tuning items. For managed services, the service catalogue, response expectations and reporting cadence formally begin at handover. Ongoing work after go-live usually centres on DLP policies, SaaS findings, remote browser isolation triggers and Private Access rules, so plan who will own that work. Co-management is a middle path if your team wants to stay hands-on but lacks the time to do it alone. URL: https://www.firstnet.co.za/knowledge/security/is-a-managed-service-included-by-default/. Reviewed 2026-10-10. #### Is an SPF record enough to stop attackers spoofing our email domain? No. SPF only declares which mail servers are allowed to send for your domain, and attackers can still spoof the address your recipients actually see. DMARC is needed to enforce the check: it requires the visible From domain to align with an authenticated SPF or DKIM domain, and tells receiving mail providers to quarantine or reject mail that fails. SPF also has practical limits. It is restricted by a DNS lookup count and is easily misaligned when you use several sending platforms, such as Microsoft 365, a marketing tool and an ERP system. Many organisations have an SPF record but no alignment and no enforced DMARC policy, which leaves their domain open to impersonation. Closing the gap needs three things: - SPF and DKIM configured and aligned for every legitimate sending source - A DMARC record that moves from p=none to p=quarantine to p=reject - Ongoing monitoring, because new platforms start sending as your domain over time FirstNet's managed SendMarc service does the source discovery and specifies the SPF and DKIM changes, your administrators apply them, and FirstNet validates them before each enforcement step. Cyber insurers and audits increasingly ask whether DMARC is enforced, not just whether SPF exists. URL: https://www.firstnet.co.za/knowledge/security/is-an-spf-record-enough-to-stop-email-spoofing/. Reviewed 2026-10-10. #### Is email data in FirstNet's managed Mimecast service kept in South Africa? FirstNet delivers its managed Mimecast service from South Africa, and the Mimecast platform supports South African data residency preferences. If you need specific residency wording in your contract, or a mapping to regulatory controls, FirstNet's product and legal teams review it before any commitment. What this means for POPIA planning: - You discuss residency preferences in the onboarding technical workshop, along with retention and archiving. - Archive retention can be set to 30 days, 1 year, 7 years or 99 years, where archiving is contracted. - You keep ownership of your mailbox content and make the final calls on retention and governance. - FirstNet escalates security questionnaires and audit evidence requests for formal review. It does not answer them informally. Compliance is a shared job. It depends on both the platform and your own settings and governance. FirstNet aligns the service to your privacy and retention needs, but it does not guarantee POPIA compliance. If residency is a hard requirement, say so at the start of discovery. That way it can be reviewed before you sign a contract. URL: https://www.firstnet.co.za/knowledge/security/is-mimecast-email-data-kept-in-south-africa/. Reviewed 2026-10-10. #### Is the 24/7 SOC in FirstNet's managed cybersecurity service run by FirstNet? No. Sophos MDR runs the 24/7 SOC (security operations centre) layer that monitors, hunts and alerts around the clock. FirstNet's Incident Response team acts on those alerts with you, and FirstNet also handles onboarding, reporting and escalation. Who does what: - Sophos MDR: 24/7 detection, threat hunting and analyst-led response across your systems. - FirstNet support desk: receives the Sophos alert. - FirstNet Incident Response: works with you to contain the threat, fix it and recover, following a runbook agreed at onboarding. - FirstNet's wider service: onboarding, setup, customer success, compliance reports and escalation. How much FirstNet does depends on your support tier. Standard covers incident response on Sophos alerts. Enhanced adds a named customer-success contact, more incident response, longer telemetry retention and more reports. Premium adds extended incident response, with on-site remediation support where it applies. It also adds executive reports and dedicated runbook engineering. FirstNet is a Sophos MSP and Titanium Partner, with direct escalation into Sophos when an issue needs it. Your runbook sets who in your business is told and who steps in. So agree it with care at onboarding. URL: https://www.firstnet.co.za/knowledge/security/is-the-24-7-soc-run-by-firstnet/. Reviewed 2026-10-10. #### Should our firewall be on site or hosted by FirstNet? An on-site firewall suits organisations with data sovereignty or latency requirements, local internet breakout, or high WAN throughput, because the appliance sits on your premises. A hosted firewall suits organisations that want managed protection without owning or maintaining an appliance, prefer a monthly operating expense, or are rolling out many sites where a centrally hosted service is simpler to operate. Other factors FirstNet weighs: - Design flexibility: a dedicated on-site firewall offers the most customer-specific design and dedicated HA - Cost model: a hosted firewall avoids buying an appliance, and Fortinet Hosted VDOM can act as the firewall layer for FirstNet Private Cloud workloads - Features: Sophos offers the same feature set on site or hosted, set by Standard or Xstream Protection; on Fortinet, Hosted VDOM Lite suits simpler needs while Enterprise adds advanced security - Responsibility: with a hosted firewall, on-site cabling, ISP handoffs and local switching stay with you unless scoped FirstNet manages both options, and the right choice is usually confirmed in a short discovery session covering sites, users, links and VPN needs. URL: https://www.firstnet.co.za/knowledge/security/should-our-firewall-be-on-site-or-hosted-by-firstnet/. Reviewed 2026-10-10. #### We already have Microsoft Defender for Office 365. Why add Mimecast through FirstNet? Mimecast adds an independent, specialist email security layer in front of Microsoft 365, with its own threat intelligence, sandboxing and URL rewriting, plus continuity if Microsoft 365 itself is down. FirstNet also runs the tuning, threat workflows and DMARC programme for you. The value is defence in depth plus an operating model: - A separate filtering layer, so one vendor's detection gap is not your only line of defence - Impersonation and business email compromise protection, including protection for internal email after an account is compromised (Resilience tier and above) - Email continuity through Outlook, web and mobile apps during a Microsoft 365 outage, where contracted - Archiving with retention from 30 days to 99 years, where contracted - FirstNet operating the platform: baseline policies, ongoing tuning of allow and block rules, quarantine and release workflows, threat triage and monthly reporting Microsoft's own controls remain the baseline. Mimecast complements them rather than replacing your mail platform, and it integrates with Entra ID, SIEM and ticketing tools. If your team lacks the time to tune and investigate email threats every day, this managed layer takes that work off them. URL: https://www.firstnet.co.za/knowledge/security/we-already-have-microsoft-defender-for-office-365-why-add-mimecast/. Reviewed 2026-10-10. #### We already have a SIEM. Where do FirstNet's Sophos XDR and MDR services fit? If your SIEM is working well, Sophos XDR and MDR can complement it. If it is expensive to operate, slow to deploy or weak on response, Sophos NG-SIEM can replace it as part of a planned transformation run by FirstNet. The two paths: - Complement: keep your SIEM for log management and compliance, and add Sophos XDR to correlate endpoint, firewall, identity, cloud and email telemetry, with Sophos MDR analysts monitoring 24/7 and FirstNet Incident Response acting on alerts - Replace: Sophos NG-SIEM provides telemetry ingestion, compliance reporting, log retention and SOAR automation, unified through the Sophos Unified Data Lake Typical timeframes: - Standard MDR onboarding: two to four weeks - XDR or NG-SIEM integration: four to eight weeks, depending on telemetry breadth - Full legacy SIEM replacement: eight to 16 weeks The deciding questions are usually the cost to operate, how long new detections take to deploy, and whether alerts lead to action. MDR adds the people who watch and respond, which a SIEM on its own does not provide. FirstNet's discovery reviews your SIEM's age, renewal date and pain points before recommending a path. URL: https://www.firstnet.co.za/knowledge/security/we-already-have-a-siem-where-does-this-fit/. Reviewed 2026-10-10. #### We already use Microsoft Defender. Do we have to replace it to use Sophos MDR from FirstNet? No. Sophos XDR and MDR can ingest Microsoft Defender telemetry, so you can consolidate it into analyst-led detection and response rather than rip it out. How it works: - Defender telemetry feeds into Sophos XDR, which correlates it with signals from firewalls, identity, cloud and email - Sophos MDR analysts monitor and hunt across that combined telemetry 24/7 - When Sophos raises an alert, FirstNet's Incident Response team works with you to contain, remediate and recover - Third-party firewall, EDR and identity sources can also connect through XDR connectors, and Sophos connects to Microsoft 365, Azure, AWS and Google Workspace This addresses the skills shortages and alert fatigue that in-house teams face, without discarding tools you have already deployed. Standard MDR onboarding typically takes two to four weeks, covering discovery, a deployment plan, telemetry validation and an agreed incident response runbook. Integrating additional XDR or NG-SIEM data sources usually takes four to eight weeks, depending on how many sources are connected. A FirstNet specialist can review your current Defender set-up and recommend which telemetry to connect first. URL: https://www.firstnet.co.za/knowledge/security/we-already-use-microsoft-defender-do-we-have-to-replace-it/. Reviewed 2026-10-10. #### What Mimecast email security tiers does FirstNet offer, and what does each include? FirstNet offers Mimecast email security in three tiers: Essentials, Resilience and Complete. FirstNet runs each one as a managed service, with onboarding, policy tuning, threat triage and escalation to Mimecast. What each tier covers: - Essentials: anti-spam, anti-malware and anti-phishing, with link and attachment sandboxing, plus basic awareness nudges. It is a stronger front door than built-in filters, and it suits smaller firms. - Resilience (recommended): all of Essentials, plus protection from impersonation and business email compromise. It adds internal email protection after an account is taken over, and managed DMARC. Where contracted, it also includes email continuity and a full awareness training programme. - Complete: all of Resilience, plus Brand Exploit Protect, Sync & Recover, web security, Large File Send and Secure Messaging. It also has a 99-year archive option and executive human-risk reports. It suits regulated or high-risk firms. You can add archiving to any tier, with 30-day, 1-year, 7-year or 99-year retention. Continuity, archiving and awareness come only where contracted, so check the scope in your proposal. Most mid-sized and large firms start with Resilience. They add archiving or other options when discovery shows a need. URL: https://www.firstnet.co.za/knowledge/security/what-mimecast-service-tiers-does-firstnet-offer/. Reviewed 2026-10-10. #### What are managed cybersecurity services, and how does FirstNet deliver them? Managed cybersecurity services are security controls that a provider deploys, monitors and runs for you on an ongoing basis, instead of your team buying and operating each tool. FirstNet delivers managed cybersecurity across your network, cloud platforms, users and devices to reduce cyber risk and improve resilience. FirstNet designs security as part of your wider IT infrastructure, alongside cloud, connectivity and communications, and runs each platform as a managed service rather than reselling licences. A typical estate combines several layers: - Firewall as a Service on Fortinet or Sophos, on your site or hosted by FirstNet - Mimecast for inbound email and SendMarc for DMARC on outbound email - Sophos endpoint protection with Sophos MDR for 24/7 detection - Netskope or Cloudflare Zero Trust for secure access, and Cloudflare for public-facing apps Sophos MDR provides the 24/7 security operations layer, and FirstNet's Incident Response team works with you to contain, remediate and recover when it raises an alert. You deal with one contract and one support desk, Rapid Response, while FirstNet handles escalation into each vendor. A FirstNet security specialist can help you decide which layer to start with. URL: https://www.firstnet.co.za/knowledge/security/what-are-managed-cybersecurity-services/. Reviewed 2026-10-10. #### What certifications and security partner accreditations does FirstNet hold? FirstNet runs ISO 27001 (information security) and ISO 9001 (quality) management systems, and holds ECS and ECNS licences from ICASA. It is also a Sophos Titanium Partner, a Mimecast Elite partner, and a Fortinet, Cloudflare and Netskope partner. Its security vendors hold their own certificates for their platforms, and you can ask to see them. FirstNet holds partner status with each platform it runs as a managed service: - Sophos Titanium Partner and MSP: Titanium is the top tier of the Sophos Partner Program. It comes with advanced certification and a direct path to escalate issues into Sophos for firewall, endpoint and MDR clients. - Mimecast Elite Managed Services Partner, in the Mimecast Partner ONE MSP Programme. - Fortinet partner: FirstNet runs FortiGate firewalls, FortiManager and FortiAnalyzer for several client estates in live use. It escalates to Fortinet TAC through FortiCare. - Cloudflare and Netskope partner, with partner-tier escalation to each vendor's tech teams. Certificates do not move your compliance duties to FirstNet. Compliance stays a shared job. FirstNet's product and legal teams review formal security questionnaires and contract wording. Ask FirstNet for the certificates or vendor statements that your buying or audit process needs. URL: https://www.firstnet.co.za/knowledge/security/what-certifications-does-firstnet-hold/. Reviewed 2026-10-10. #### What do we need to provide to onboard Cloudflare with FirstNet? You need control of DNS for the domains being protected, plus proof of domain ownership. For Zero Trust, FirstNet needs your identity provider details and a catalogue of the applications in scope with their owners. For Magic Transit, FirstNet needs your public IP ranges and ASN. The full checklist: - DNS control and proof of ownership for each domain to be proxied - Identity provider details: SAML or OIDC endpoint, attribute mapping and MFA set-up - An application catalogue: apps, owners and current access methods - Public IP ranges and ASN details for Magic Transit - A named technical contact for service requests and approvals - Agreed change windows and acceptance criteria before cutover FirstNet then follows a staged delivery: discovery and design, account set-up with SSO, MFA, audit logging and role-based access, onboarding by product family, policy hardening and SIEM integration, cutover and handover, then ongoing managed tuning. Details of existing WAF, VPN, CDN or MPLS investments also help FirstNet plan a phased migration. If your identity provider needs work first, FirstNet identifies the gaps early so they do not delay cutover. URL: https://www.firstnet.co.za/knowledge/security/what-do-we-need-to-provide-to-onboard-cloudflare/. Reviewed 2026-10-10. #### What does FirstNet's Microsoft 365 security and compliance service include? FirstNet's Microsoft 365 security and compliance service hardens identities, devices, apps and data in your tenant using zero-trust best practice. Controls are tailored to your risk profile and compliance needs, so security supports productivity rather than hindering it. Microsoft 365 includes strong security features, but they protect you only once they are configured for your risks, and some depend on your licence level. Misconfigurations and weak identity controls are the root cause of many breaches, while regulations such as POPIA add pressure for data governance, retention and auditability. The service covers five layers: - Identity security: multi-factor authentication (MFA), conditional access and privileged identity management, which limits standing administrator rights - Device and app control: endpoint hardening and application governance - Data protection: data loss prevention, sensitivity labels, encryption and retention - Threat protection: phishing defence, safe links and safe attachments - Compliance: audit trails, eDiscovery and regulatory reporting, with reports and dashboards configured to support audits and regulatory checks Engagements range from targeted hardening to a full zero-trust programme with policy baselines and continuous monitoring. Delivery follows four stages: - Assessment: a tenant review, gap analysis and prioritised action plan - Implementation: policy baselines, staged rollouts and change control - Monitoring: dashboards for incidents, drift and user risk signals - Enablement: admin and end-user training to sustain the improvements Stronger security does not have to slow people down. FirstNet prioritises controls that add protection with minimal friction, and phases each change with clear communication to users. Alerts and logs can also be forwarded to your SIEM for central visibility. Licensing matters here. Conditional access and privileged identity management depend on your Microsoft Entra ID licence level. FirstNet is a Microsoft Cloud Solution Provider and can supply Entra security add-ons if your current licences fall short. Where you need more than Microsoft's own controls, FirstNet adds independent layers: - Mimecast in front of Microsoft 365, with separate threat intelligence, sandboxing and URL rewriting - Sophos MDR, which can ingest Microsoft Defender telemetry, so you keep Defender and add analyst-led detection around the clock - A cloud access security broker (CASB) through Netskope or Cloudflare, to find risky sharing, risky OAuth grants and unsanctioned apps - Druva backup for Exchange, OneDrive, SharePoint and Teams as a companion service, because retention in Microsoft 365 is not the same as backup Some things stay with you. Under POPIA your organisation remains the responsible party, and the outcome depends on how your tenant is configured and governed over time. FirstNet's controls support compliance, but no provider can guarantee it on its own. A Microsoft 365 security assessment is the usual first step for prioritising quick wins and long-term guardrails. URL: https://www.firstnet.co.za/knowledge/security/what-does-microsoft-365-security-and-compliance-service-include/. Reviewed 2026-10-11. #### What happens if our logs outgrow our FirstNet FortiAnalyzer storage bundle? Your storage bundle is a hard ceiling, but FirstNet monitors ingestion trends and alerts you before you reach it so the bundle can be stepped up. There are no silent overage charges. What you need to know: - Logs above the ceiling are dropped, not queued, so acting on FirstNet's alerts matters - Bundles step up in 50 GB increments, so an uplift is a straightforward change - FirstNet monitors capacity and ingestion continuously as part of the managed service - Log volume can change quickly; switching on full SSL deep inspection mid-contract, for example, can double daily volume overnight Because log estimates are only estimates, FirstNet recommends re-baselining log volume after about six months. That check confirms whether your bundle still matches your devices, inspection settings and retention period. To avoid gaps in your log history, tell FirstNet before changes that increase logging, such as adding sites or widening SSL inspection, so the bundle can be adjusted in advance rather than after an alert. URL: https://www.firstnet.co.za/knowledge/security/what-happens-if-our-logs-outgrow-our-fortianalyzer-storage-bundle/. Reviewed 2026-10-10. #### What happens to our Fortinet firewalls if FirstNet's FortiManager goes down? Your FortiGates keep enforcing policy locally during a management-plane outage, so traffic is not dropped. FortiManager only configures and orchestrates devices; it does not inspect traffic itself. How FirstNet protects the management plane: - Production FortiManager runs as a high-availability (HA) pair - Configuration is backed up daily - A documented recovery runbook is in place - By default, FortiManager runs as a VM on FirstNet Private Cloud in South Africa During an outage, the main impact is that new policy changes cannot be pushed until management is restored. Existing policies, VPNs and security profiles on your firewalls keep working as configured. FortiManager also keeps device-level and ADOM-level revision history, so configurations can be rolled back to a known-good state if recovery ever needs it. Incidents are logged through FirstNet's Rapid Response desk, and FirstNet escalates product or platform faults into Fortinet TAC under FortiCare, so you do not have to manage the vendor yourself. URL: https://www.firstnet.co.za/knowledge/security/what-happens-if-fortimanager-goes-down/. Reviewed 2026-10-10. #### What happens to our firewall data and configuration when a FirstNet contract ends? You retain ownership of your data and configurations. FirstNet supports an agreed handover and deprovisioning process, and FortiAnalyzer logs are exportable on exit. Migration work outside the standard service is scoped separately. What to expect at exit: - Exit terms, notice periods and handover obligations are set by your contracted terms and conditions - FirstNet supports an agreed handover and deprovisioning process in line with the contracted scope - FortiAnalyzer as a Service logs and reports can be exported, with any export work outside the standard service scoped explicitly - Migration, rebuild or replacement activity, such as moving to another provider's platform, is quoted as separate work The same principle applies across FirstNet's firewall services, whether Fortinet or Sophos, on site or hosted. If you have special exit or migration requirements, such as a regulator expecting a particular handover format or periodic raw log exports, confirm them during contracting so they are written into your terms rather than negotiated at the end. URL: https://www.firstnet.co.za/knowledge/security/what-happens-to-our-data-when-the-contract-ends/. Reviewed 2026-10-10. #### What happens to our website if Cloudflare has a problem? Cloudflare publishes its operational status, and FirstNet designs your deployment around your risk tolerance. Depending on the service, that can include documented DNS fallback procedures, BGP failover for Magic Transit, and alternate paths for business-critical applications. How FirstNet plans for resilience: - Discovery captures your resilience requirements and which applications are business-critical - Cloudflare's value depends on DNS or BGP pointing at its edge, so FirstNet documents fallback procedures aligned with your existing DNS or BGP playbook - Failover is validated with your network team during onboarding - Change windows are aligned with your operations - Issues are logged through FirstNet's Rapid Response desk, which escalates into Cloudflare's technical account team FirstNet does not quote uptime figures outside your contracted terms, so resilience requirements are agreed during design and reflected in your contract. If your website is revenue-critical, ask for the fallback procedure to be part of the acceptance criteria agreed before cutover, so you know it has been tested rather than only documented. URL: https://www.firstnet.co.za/knowledge/security/what-happens-to-our-website-if-cloudflare-has-a-problem/. Reviewed 2026-10-10. #### What happens when Sophos MDR detects a threat in a FirstNet-managed environment? Sophos MDR analysts spot the threat and send an alert to FirstNet's support desk. FirstNet's Incident Response team then works with you to contain the threat, fix the cause and recover. Sophos MDR is the 24/7 security operations layer: its analysts hunt for threats and flag suspicious activity. The steps after a detection: - Detection: Sophos MDR analysts find suspicious activity in your telemetry. - Alert: Sophos notifies FirstNet's support desk. - Response: FirstNet's Incident Response team contacts the people you nominated. - Containment and remediation: FirstNet works with you to contain the threat and deal with the cause, following the agreed playbook. - Recovery: systems return to normal. Where Druva backup is in place, clean data can be restored. During onboarding, you agree an incident response runbook with FirstNet. It sets how alerts arrive, who steps in and which remediation playbook applies. If you use Sophos endpoints and a Sophos firewall, Security Heartbeat can also isolate a compromised device automatically. FirstNet does not run its own SOC. The Premium support tier extends incident response to on-site remediation support where it applies. URL: https://www.firstnet.co.za/knowledge/security/what-happens-when-sophos-mdr-detects-a-threat/. Reviewed 2026-10-10. #### What is BIMI, and how can FirstNet get our logo shown in email inboxes? BIMI (Brand Indicators for Message Identification) displays your verified brand logo next to your emails in supporting mailbox clients such as Gmail, Apple Mail and Yahoo. It only works once your DMARC policy is enforced at p=quarantine or p=reject, and most mailbox providers also require a Verified Mark Certificate (VMC), which is backed by a registered trade mark. FirstNet's optional BIMI add-on to its managed SendMarc service covers: - Publishing the BIMI DNS record - Hosting your logo in the required SVG format - Help procuring the Verified Mark Certificate where it is required The order of work matters. FirstNet first takes your domain through the DMARC journey: discovering every sending source, aligning SPF and DKIM, then enforcing quarantine or reject. BIMI is deployed after enforcement. If your brand does not yet have a registered trade mark, the route to BIMI is staged until a certificate can be obtained. BIMI is also a visible sign that your domain is properly protected against spoofing, so it is worth involving your marketing and brand team early in the DMARC project. URL: https://www.firstnet.co.za/knowledge/security/what-is-bimi-and-how-do-we-get-our-logo-shown-in-email-inboxes/. Reviewed 2026-10-10. #### What is Cloudflare Magic Transit, and who needs it? Magic Transit provides always-on DDoS protection for an entire IP range. Cloudflare advertises your IP prefixes from its global network using BGP, filters malicious traffic at the edge and tunnels clean traffic back to you. Who it suits: - Organisations with their own ASN or IP space - Those needing DDoS protection beyond what their upstream carrier provides - Customers on FirstNet IP Transit who want always-on network-layer protection on top How FirstNet delivers it: - Discovery of your public IP ranges, ASN and current routing - Design of the BGP topology, with GRE or IPsec tunnels for returning clean traffic - Failover validated with your network team during onboarding - Ongoing attack-event reviews and service reviews as part of the managed service Magic Transit protects at the network layer (layer 3). Public web applications also benefit from Cloudflare's WAF and application-layer DDoS protection, which can be combined with it. To onboard, FirstNet needs your public IP ranges and ASN, a named technical contact, and agreed change windows and acceptance criteria. URL: https://www.firstnet.co.za/knowledge/security/what-is-cloudflare-magic-transit/. Reviewed 2026-10-10. #### What is DMARC email authentication, and why does it matter for our domain? DMARC (Domain-based Message Authentication, Reporting and Conformance) is the email standard that lets you tell receiving mail servers what to do with messages that falsely claim to come from your domain. Without DMARC enforcement, anyone can put your domain in the From line of an email, which is how most business email compromise, invoice fraud and executive-impersonation attacks work. DMARC works with two other standards: - SPF lists the mail servers allowed to send for your domain - DKIM adds a cryptographic signature proving a message was authorised by your domain - DMARC requires the visible From domain to align with an authenticated SPF or DKIM domain, and tells receivers how to handle mail that fails A DMARC policy has three settings: p=none only reports failures, p=quarantine sends failing mail to spam, and p=reject blocks it. Only an enforced policy of p=reject actually stops spoofing, yet most domains have no DMARC record or sit at p=none. FirstNet's managed SendMarc service takes you from monitoring to p=reject safely, authenticating every legitimate sender first so marketing and transactional email keeps flowing. URL: https://www.firstnet.co.za/knowledge/security/what-is-dmarc-and-why-does-it-matter/. Reviewed 2026-10-10. #### What is FortiAnalyzer as a Service (FAZaaS) from FirstNet? FAZaaS is FirstNet's managed FortiAnalyzer service for centralised log analytics, compliance reporting, threat correlation and incident investigation across your Fortinet devices. FirstNet runs a dedicated FortiAnalyzer-VM instance for you on FirstNet-operated infrastructure in South Africa. What is included: - A dedicated FortiAnalyzer-VM sized to your storage bundle - Hosting within FirstNet's South African hosting footprint - Patching, upgrades, backups and routine platform operations - Capacity and health monitoring, with alerts before you reach your bundle ceiling - Standard reporting and managed-service support aligned to your contracted scope You pay a monthly service in rands based on a storage bundle, so there is no hardware to buy, no virtual machine to run and no Fortinet licence to manage yourself. Bundles start at 50 GB and step up in 50 GB increments. FAZaaS works with FortiManager, also run by FirstNet, so devices register once, logs flow automatically and reports can be cross-referenced against policy revisions. It is not a SIEM, but logs can be forwarded to one if scoped. Under normal operation, log data stays in South Africa. URL: https://www.firstnet.co.za/knowledge/security/what-is-fortianalyzer-as-a-service-fazaas/. Reviewed 2026-10-10. #### What is Sophos Synchronized Security, and does FirstNet include it? Synchronized Security lets a Sophos firewall and Sophos endpoint protection (Intercept X) share information automatically. Through Security Heartbeat, each device reports a real-time health status, and the firewall can automatically isolate a compromised device from the network. It is included when you run a Sophos firewall alongside another Sophos product. How it works in FirstNet's service: - Security Heartbeat is included in both Standard and Xstream Protection - FirstNet enables Heartbeat in Sophos Central, for on-site and hosted firewalls - You manage the Sophos endpoint deployment yourself, or contract FirstNet to do it - Sophos MDR can be added to a Sophos firewall on the same monthly bill for 24/7 detection The health signal is red, amber or green. When an endpoint reports a red status, the firewall can cut it off from the network before a threat spreads to other systems. You can keep a different endpoint vendor and the Sophos firewall will still protect you, but this automatic firewall-to-endpoint response only works with Sophos endpoints. Sophos endpoint protection can be added as a later phase if you are not ready to switch now. URL: https://www.firstnet.co.za/knowledge/security/what-is-sophos-synchronized-security/. Reviewed 2026-10-10. #### What is a VDOM in FirstNet's hosted Fortinet firewall service? A VDOM (Virtual Domain) is an isolated firewall instance running on shared FortiGate hardware, giving you dedicated policies and logs without a physical device on your premises. FirstNet uses Fortinet VDOMs to deliver its Hosted VDOM firewall service, with a separate security context for each customer or business unit. How Hosted VDOM works: - Each VDOM has its own firewall policies, NAT, routing and logs, separate from other tenants - FirstNet's security team manages policies, logging and updates centrally - Capacity or features can be added without on-site hardware swaps - It can act as the firewall layer for FirstNet Private Cloud workloads and connected sites Hosted VDOM comes in two options. Lite covers basic firewalling, NAT, routing, segmentation and site-to-site VPN for simpler environments. Enterprise adds intrusion prevention, antivirus, web filtering, application control, SSL inspection and SD-WAN where required and sized correctly. A VDOM is a shared-platform service, so it offers less customer-specific design flexibility than a dedicated firewall. If you need dedicated HA or deep customisation, FirstNet's On Prem FWaaS places a FortiGate at your site instead. URL: https://www.firstnet.co.za/knowledge/security/what-is-a-vdom/. Reviewed 2026-10-10. #### What is a managed firewall service? A managed firewall service means a provider runs your firewall for you: setup, policy, updates, monitoring, changes and incident response. Your team approves scope and changes instead of operating the platform. Firewall as a service (FWaaS) is another name for the same idea. The firewall can sit at your site or be hosted on the provider's platform, and either way the provider owns day-to-day operation within an agreed scope. What a FirstNet managed firewall includes: - Design and policy: zones, segmentation and least-privilege access - Build and onboarding: rules migrated safely with validation and rollback plans - Operation: patching, ruleset hygiene, monitored alerts, tuning and regular posture reviews - Change management through approved workflows with testing and rollback - Reporting: monthly summaries, change records and improvement actions FirstNet offers the service on Fortinet or Sophos. You first choose where the firewall lives, a dedicated appliance at your site or a hosted firewall on FirstNet's platform, then the level of protection. Support is available as 8x5 or 24x7. A managed service suits organisations that need strong segmentation, consistent policy and 24/7 monitoring across sites and cloud, without the slow scaling and cost of running appliances themselves. You stay responsible for your internal LAN, endpoints and applications, and for approving changes through authorised contacts. Onsite hands-and-feet support, full network redesigns, security audits and penetration tests are scoped separately. FirstNet sizes the firewall on your real inspected traffic, not your line speed, during a short discovery session before recommending an on-site or hosted option. URL: https://www.firstnet.co.za/knowledge/security/what-is-a-managed-firewall-service/. Reviewed 2026-10-11. #### What is firewall as a service (FWaaS), and how does FirstNet deliver it? Firewall as a service is a managed firewall service: instead of buying and running the firewall platform yourself, FirstNet provides, configures and supports it for you. FirstNet handles firewall policy, updates, monitoring, change management and incident response within the agreed scope. FirstNet offers FWaaS on two platforms, on site or hosted: - Fortinet On Prem FWaaS: a dedicated FortiGate at your site, for local control, customisation or dedicated HA - Fortinet Hosted VDOM Lite or Enterprise: a hosted firewall on FirstNet's FortiGate platform - Sophos On-Premise FWaaS: a dedicated Sophos Firewall XGS appliance at your site, managed through Sophos Central - Sophos Shared Firewall: a dedicated Sophos Firewall Virtual instance per customer on FirstNet's platform Sophos options come with Standard or Xstream Protection. Support is available in 8x5 or 24x7 options through Rapid Response, under your contracted SLA. You remain responsible for your internal LAN, endpoints and applications unless separately agreed. Onsite hands-and-feet support, full network redesigns, security audits and penetration testing are outside the standard service. FirstNet sizes the firewall on your real inspected traffic during a short discovery session. URL: https://www.firstnet.co.za/knowledge/security/what-is-firewall-as-a-service-fwaas/. Reviewed 2026-10-10. #### What is remote browser isolation (RBI), and how does Netskope use it? Remote browser isolation (RBI) opens risky or uncategorised websites in an isolated session away from the user's device, so potentially malicious code never runs on the endpoint. Users can still view the content, which means security teams can reduce risk without blocking large categories of websites outright. Why organisations use RBI: - It closes the gap between allowing and blocking: risky or uncategorised sites can be viewed safely instead of being blocked - It reduces over-blocking and the user frustration that comes with it - It adds protection for high-risk users, such as executives, who are frequent targets In Netskope, RBI is part of the same platform as the secure web gateway, CASB and DLP, so isolation policies use the same console and policy engine. FirstNet tunes RBI triggers after go-live, alongside DLP policies and SaaS findings, so isolation applies where it adds protection without getting in the way of everyday work. Customers often add RBI after a secure web gateway refresh. FirstNet also delivers Cloudflare Browser Isolation, which renders risky sites remotely and sends only pixels to the device. URL: https://www.firstnet.co.za/knowledge/security/what-is-remote-browser-isolation/. Reviewed 2026-10-10. #### What is the difference between Fortinet Hosted VDOM Lite and Enterprise at FirstNet? Hosted VDOM Lite is for simpler needs: basic firewalling, NAT, routing and VPN. Hosted VDOM Enterprise adds advanced security and networking, including unified threat management features such as intrusion prevention, antivirus, web filtering and application control, plus SSL inspection and SD-WAN where required. Comparing the two: - Both include firewalling, NAT, routing and site-to-site VPN; remote-access VPN depends on the agreed scope - IPS, antivirus, web filtering and application control: limited in Lite, available in Enterprise where required - SSL inspection: not the default fit for Lite, available in Enterprise where required and sized correctly - SD-WAN: Enterprise only - Customer-specific design flexibility: low for Lite, medium for Enterprise - Both run on FirstNet's shared FortiGate platform as a managed service, with 8x5 or 24x7 support Lite suits small or simple environments that want a hosted managed firewall. Enterprise suits organisations that need hosted threat protection and more advanced networking. If you need a dedicated firewall with more customer-specific design flexibility, FirstNet's On Prem FWaaS track places a FortiGate at your site instead. URL: https://www.firstnet.co.za/knowledge/security/what-is-the-difference-between-fortinet-hosted-vdom-lite-and-enterprise/. Reviewed 2026-10-10. #### What is the difference between Fortinet Hosted VDOM and Sophos Shared Firewall at FirstNet? Hosted VDOM gives you an isolated virtual firewall instance on FirstNet's shared FortiGate platform. Sophos Shared Firewall gives each customer a dedicated Sophos Firewall Virtual machine on FirstNet's hypervisor. Both are hosted and managed by FirstNet; the right choice depends on your preferred platform and feature needs. Key differences: - Tenancy: a VDOM is a logical partition of a shared FortiGate, while Sophos Shared Firewall separates customers by giving each its own firewall VM, with no multi-VDOM sharing - Protection levels: Hosted VDOM comes as Lite (basic firewalling and VPN) or Enterprise (adds IPS, antivirus, web filtering, application control, SSL inspection and SD-WAN); Sophos comes with Standard or Xstream Protection - Management: Fortinet estates can be run through FortiManager with FortiAnalyzer logging, while Sophos is managed through Sophos Central - Ecosystem: Sophos Synchronized Security can isolate compromised devices automatically if you use Sophos endpoints In both cases FirstNet configures, monitors, updates and supports the firewall, and support is available as 8x5 or 24x7. A short discovery session covering your sites, users, links and VPN needs confirms the best fit. URL: https://www.firstnet.co.za/knowledge/security/what-is-the-difference-between-fortinet-hosted-vdom-and-sophos-shared-firewall/. Reviewed 2026-10-10. #### What is the difference between Mimecast and SendMarc in FirstNet's email security? Mimecast is inbound protection: it stops phishing and malware reaching your users. SendMarc is outbound brand protection: it stops anyone spoofing your domain to attack your customers and suppliers. Most organisations need both, and FirstNet runs both as managed services. How they differ: - Mimecast sits in front of Microsoft 365, Google Workspace or Exchange and filters spam, malware, phishing, impersonation and malicious links and attachments before delivery - SendMarc manages your DMARC, SPF and DKIM set-up, identifies every system sending email as your domain, and takes your policy to p=reject so criminals cannot put your domain in the From line - Mimecast protects your staff, while SendMarc protects everyone who receives email from you - Mimecast adds optional continuity, archiving and awareness training; SendMarc adds optional BIMI logo display and look-alike domain takedown Neither replaces the other. DMARC does not stop a phishing email arriving from someone else's domain, and an inbound gateway cannot stop attackers spoofing your domain to your customers. A FirstNet specialist can help you decide which to start with, based on whether your bigger risk today is inbound phishing or impersonation of your brand. URL: https://www.firstnet.co.za/knowledge/security/what-is-the-difference-between-mimecast-and-sendmarc/. Reviewed 2026-10-10. #### What is the difference between SSE and SASE, and where does Netskope fit? Security Service Edge (SSE) is a group of cloud-delivered security services that protect users and their access, such as a secure web gateway, cloud access security broker, data loss prevention and zero trust network access. Secure Access Service Edge (SASE) combines those security services with networking, such as SD-WAN, in one cloud model. In practice: - SSE secures how users reach the internet, SaaS apps and private apps, wherever they work - SASE adds the network layer, connecting and steering traffic between sites and users as well as securing it - Netskope delivers SSE capabilities on one platform, with one console, one client and one policy engine, plus wider SASE capabilities - Netskope traffic runs over NewEdge, its private cloud backbone Many organisations start with SSE and add networking as their needs grow. FirstNet also offers SD-WAN and failover in its connectivity portfolio, so the security and network layers can come from one provider. Most Netskope customers begin with one urgent SSE use case, such as a proxy refresh or VPN replacement, and expand from there once it has proved its value. URL: https://www.firstnet.co.za/knowledge/security/what-is-the-difference-between-sse-and-sase/. Reviewed 2026-10-10. #### What is the difference between Sophos Standard Protection and Xstream Protection at FirstNet? At FirstNet, Sophos Standard Protection covers core firewall needs. Xstream Protection adds zero-day protection, SD-WAN orchestration, DNS Protection, NDR Essentials and advanced reporting, with 30-day cloud log retention. Standard covers the firewall itself, NAT, routing, VPN between sites and for remote access, and intrusion prevention. It also covers web protection, app control, TLS inspection and Sophos X-Ops threat intelligence. Both bundles include Security Heartbeat, which links the firewall to Sophos endpoints for Synchronized Security. Both also run TLS inspection on the Xstream FastPath engine, and Active Threat Response with X-Ops intel. What only Xstream adds: - Sandboxing, and machine learning that checks unknown files, for zero-day protection. - Central Orchestration: SD-WAN, Central Firewall Reporting Advanced, and a connector for MDR and XDR. - DNS Protection, NDR Essentials and third-party threat feeds. Both bundles work whether your Sophos firewall sits on site or FirstNet hosts it. So pick based on your security needs, not where the firewall lives. Email Protection and Web Server Protection are separate add-ons. FirstNet confirms the bundle during discovery, along with sizing. That is because the features you turn on affect which firewall model is right. URL: https://www.firstnet.co.za/knowledge/security/what-is-the-difference-between-sophos-standard-protection-and-xstream-protection/. Reviewed 2026-10-10. #### What is the difference between XDR, MDR and next-generation SIEM? XDR (extended detection and response) correlates security telemetry across endpoints, firewalls, identity, cloud and email so threats are easier to spot. MDR (managed detection and response) adds people: Sophos analysts monitor, hunt and alert 24/7, with FirstNet's Incident Response team helping you remediate. Next-generation SIEM ingests telemetry at enterprise scale for compliance reporting and log retention. In short: - XDR is the technology that joins signals together - MDR is the 24/7 service that watches those signals and acts on them - NG-SIEM is the platform for large-scale log ingestion, compliance reporting, retention and SOAR automation At FirstNet, all three run on the Sophos platform, managed from Sophos Central and unified through the Sophos Unified Data Lake, so telemetry from each layer feeds detection and response. Organisations often start with endpoint protection, add XDR, then MDR, and add NG-SIEM where compliance or retention requires it. Larger enterprises often combine MDR with NG-SIEM, while compliance-heavy sectors such as financial services and healthcare lean on NG-SIEM with governance and audit reporting. A FirstNet specialist can recommend where to start based on your existing tools. URL: https://www.firstnet.co.za/knowledge/security/what-is-the-difference-between-xdr-mdr-and-next-generation-siem/. Reviewed 2026-10-10. #### What managed security support tiers does FirstNet offer with Sophos MDR? FirstNet offers its Sophos-based managed security in three tiers: Standard, Enhanced and Premium. All three include Sophos MDR's 24/7 monitoring, and FirstNet's Incident Response team acts on Sophos alerts. What each tier adds: - Standard: Sophos MDR 24/7 monitoring, threat hunting and analyst-led detection. FirstNet responds to Sophos alerts and handles customer success and escalation as your runbook sets out. - Enhanced: all of Standard, plus a named customer-success contact, more incident response support, longer telemetry retention and more reports. - Premium: all of Enhanced, plus extended incident response, with on-site remediation support where it applies. It also adds executive reports and dedicated runbook engineering. FirstNet's approved service catalogue and your contract set the service levels for each tier. They are not one-off promises made in sales talks. Your choice of tier usually comes down to three things. How much in-house security capacity do you have? What are your retention and reporting duties? Would you want on-site help during an incident? FirstNet confirms the tier during discovery, along with which telemetry sources to connect. URL: https://www.firstnet.co.za/knowledge/security/what-managed-security-support-tiers-are-available/. Reviewed 2026-10-10. #### When does an organisation need FortiManager, and how does FirstNet run it? FortiManager becomes valuable once you run around five or more FortiGates, because managing each device by hand leads to configuration drift and inconsistent policy. It is also a fit when an auditor asks how firewall changes are approved, evidenced and rolled back, or when you need clean separation between business units or managed customers. Common triggers: - Rolling out a fifth or later FortiGate site - Audit or regulatory questions about firewall change control - Absorbing an acquired Fortinet estate into its own ADOM before harmonising - Moving onto FirstNet Fortinet FWaaS or SD-WAN - Outages caused by manual configuration drift FirstNet runs FortiManager as a managed service, by default as a VM on FirstNet Private Cloud in South Africa. It designs the ADOM model before any device is enrolled, uses Zero-Touch Provisioning for new sites, runs a quarterly firmware programme and sends monthly reports on policy revisions, firmware drift and licence use. FortiManager is a management platform only: it does not inspect traffic or block threats itself, which remains the job of your FortiGates. URL: https://www.firstnet.co.za/knowledge/security/when-does-an-organisation-need-fortimanager/. Reviewed 2026-10-10. #### Where should we start with FirstNet if we have several cybersecurity gaps? Start with the risk that is costing you most today, whether that is phishing, an ageing firewall or VPN pain. FirstNet runs a discovery session, proposes the first service, then expands into adjacent layers once the first one is proving its value. A typical sequence looks like this: - Discovery: FirstNet reviews your current tools, users, sites, recent incidents and compliance drivers - Risk assessment, where needed: identify vulnerabilities across users, systems and connectivity, assess likelihood and business impact, check alignment to regulatory requirements and define a prioritised remediation roadmap - First service: for example Mimecast for phishing, Firewall as a Service for an ageing firewall, or Netskope or Cloudflare Zero Trust to replace a VPN - Expansion: add adjacent layers such as Sophos MDR, DMARC enforcement or a web application firewall on the same FirstNet contract Some services let you test or measure before you commit. Netskope offers a structured Proof of Value, and a monitoring-only DMARC record shows who is sending email as your domain before any enforcement. This approach avoids a disruptive rip-and-replace and puts budget where the risk is highest first. URL: https://www.firstnet.co.za/knowledge/security/where-do-i-start-if-i-have-several-security-gaps/. Reviewed 2026-10-10. #### Which email platforms does FirstNet's managed Mimecast email security support? FirstNet's managed Mimecast service works with Microsoft 365 and Exchange Online, Google Workspace, hybrid Exchange and standalone SMTP mail environments. Mimecast sits in front of your mail platform as a secure email gateway, so you keep your existing mailboxes. Integration covers more than mail flow: - Identity: Microsoft Entra ID, Google Workspace identity and other SAML or OIDC providers for single sign-on and provisioning - Security tools: API integrations with SIEM, SOAR, EDR and ticketing platforms - Continuity: Outlook for Windows and Mac, a web interface and mobile apps keep users working during a Microsoft 365 outage, where continuity is contracted - DMARC: managed DMARC is part of the Resilience tier, and SendMarc covers outbound domain protection Onboarding starts with a technical workshop on MX records, connectors, DMARC posture, identity, retention and continuity. Complex environments, such as multiple domains, multi-tenant Microsoft 365 or legacy archive ingest, get a dedicated workshop before dates are committed, and the MX cutover can be phased. Your organisation keeps control of its mail tenant, identities and mailbox content, while FirstNet operates the Mimecast layer. URL: https://www.firstnet.co.za/knowledge/security/do-you-support-multiple-mail-platforms/. Reviewed 2026-10-10. #### Which organisations need managed cybersecurity services from a provider like FirstNet? Any small, medium or large business that relies on cloud apps, the internet and digital communication needs consistent security controls. Managed cybersecurity from FirstNet is the practical way to apply them across all users and sites, without a large in-house security team. The need is strongest when one or more of these apply: - Security skills are scarce, costly or hard to keep as threats and technology change. - Threats need round-the-clock monitoring and response that a small team cannot staff. - The business wants a predictable running cost, not capital spend on separate tools. - POPIA and other governance duties call for controls that are visible, auditable and applied the same way each time. - Staff work across head office, branches and home, beyond the traditional network perimeter. FirstNet supports clients in financial services, healthcare, legal and professional services, manufacturing, and retail and logistics. South African businesses also face local factors. These include POPIA and data sovereignty rules, and ransomware and fraud aimed at local firms. They also include regional branch connectivity, and reliance on dependable network and cloud uptime. A discovery session with FirstNet shows which risks matter most for you and where to start. URL: https://www.firstnet.co.za/knowledge/security/who-needs-managed-cybersecurity-services/. Reviewed 2026-10-10. #### Who do we call when FirstNet's Mimecast or SendMarc email security has a problem? Call FirstNet's Rapid Response desk, which operates 24/7 and takes tickets by email, phone or portal. Platform issues are escalated to Mimecast or SendMarc by FirstNet, so you never deal with the vendor directly. How the support path works: - Rapid Response is the single front door for incidents, service requests and everyday needs such as releasing a quarantined message - FirstNet's managed service covers policy tuning, threat triage, user release workflows, DMARC programme management, archive search support and continuity activation where contracted - Product issues that need the vendor go to Mimecast engineering through FirstNet under the Mimecast Elite MSP Programme - SendMarc platform escalations are routed through FirstNet, and authentication changes follow a joint process: FirstNet specifies, your administrator executes, FirstNet validates - Impersonation events found in SendMarc forensic reports or by Sophos MDR feed into FirstNet's incident response workflow Response, resolution and availability targets are defined in your contracted SLA. Always log a ticket first, because escalation runs through FirstNet's service management from there. URL: https://www.firstnet.co.za/knowledge/security/who-do-we-call-when-something-goes-wrong/. Reviewed 2026-10-10. #### Who do we contact at FirstNet when there is a problem with a security service? You contact FirstNet's Rapid Response support desk, whichever security platform the issue involves. Rapid Response is the single entry point for incidents, service requests and escalations, so you do not need to manage vendor support queues yourself. How support works: - You log a ticket with Rapid Response by email, phone or portal - FirstNet triages the issue and resolves it, or escalates into the vendor behind the service, such as Sophos, Fortinet, Mimecast or Cloudflare, using partner-level escalation paths - Response commitments are set by your contracted SLA, and support hours depend on the service and tier you contract, for example 8x5 or 24x7 for Firewall as a Service - Only your authorised technical contacts can log and approve service requests and changes Problems that span services stay with FirstNet. For example, a Cloudflare issue that touches FirstNet connectivity or hosting is coordinated inside FirstNet rather than handed back to you. For threats detected by Sophos MDR, FirstNet's support desk receives the Sophos notification and its Incident Response team mobilises with you under the runbook agreed during onboarding. Keep your list of authorised contacts up to date so requests are not delayed. URL: https://www.firstnet.co.za/knowledge/security/who-do-we-contact-when-there-is-a-problem-with-a-security-service/. Reviewed 2026-10-10. #### Why buy Cloudflare through FirstNet rather than directly from Cloudflare? Buying Cloudflare through FirstNet gives you local engineers in South African business hours, plus policy hardening, ongoing tuning and SIEM integration. You also get partner-tier escalation into Cloudflare, and one contract that joins Cloudflare up with FirstNet SD-WAN, DIA, Colocation, Private Cloud and IP Transit. What FirstNet's managed wrap includes: - Consultative design and deployment: FirstNet turns Cloudflare's products into a design for your setup. - Policy hardening: writing WAF rules, designing the Zero Trust app catalogue, tuning Gateway categories and setting DLP baselines. - Ongoing tuning: triage of false positives, reviews of attack events and policy updates on a set schedule. - SIEM integration: Cloudflare logs go to your SIEM or to FirstNet's monitoring. - One Rapid Response entry point, with escalation to Cloudflare's technical account team. The services also fit together. Cloudflare Zero Trust can replace VPN for FirstNet SD-WAN customers. The WAF protects apps hosted on FirstNet DIA, Colocation or Private Cloud. Magic Transit adds DDoS protection on FirstNet IP Transit. If an issue touches FirstNet links or hosting, FirstNet coordinates it in-house instead of handing it back to you. Managed support comes in two levels. Standard gives you engineers in business hours. Enhanced gives you FirstNet engineers 24x7 on critical incidents. URL: https://www.firstnet.co.za/knowledge/security/why-buy-cloudflare-through-firstnet-rather-than-directly/. Reviewed 2026-10-10. #### Will FirstNet's managed security controls slow our users down? FirstNet prioritises controls that add protection with minimal friction, and phases changes with clear communication, so users are not hit by a sudden wall of blocks and prompts. How friction is kept low across services: - Pilots first: Netskope rollouts usually start with a smaller user group so policies and traffic steering can be tested before production - Detection before enforcement: Cloudflare's WAF runs in detection mode and is tuned against real traffic before it blocks anything - Safe baselines: Mimecast starts with a baseline policy, a hyper-care tuning window and clear quarantine release workflows - Isolation instead of blocking: remote browser isolation lets users view risky sites safely rather than blocking whole categories - Phased DMARC enforcement, so legitimate marketing and transactional email keeps flowing Tuning continues after go-live as part of the managed service, based on what FirstNet sees in your environment. Performance is also considered in design. Firewalls are sized on real inspected traffic rather than line speed, and Cloudflare inspects South African traffic at its Johannesburg and Cape Town points of presence. Tell FirstNet early which users and applications are business-critical so they can be piloted carefully. URL: https://www.firstnet.co.za/knowledge/security/will-stronger-security-slow-users-down/. Reviewed 2026-10-10. #### Will adding Mimecast email security through FirstNet block legitimate email? FirstNet reduces this risk by starting with a safe baseline policy, monitoring results and continuously tuning allow and block rules to cut false positives. Clear quarantine and release workflows let users and administrators recover legitimate messages quickly. How the switch-over is managed: - A technical workshop confirms MX records, connectors, identity and mail flow before anything changes - FirstNet documents a cutover plan and baseline policies - MX cutover can be phased, followed by mail-flow validation - A hyper-care tuning window after cutover catches false positives early - The service then moves to live support through Rapid Response Ongoing tuning is part of the managed service rather than a one-off setup task, so policies keep adjusting as your mail flow and threat patterns change. FirstNet also manages quarantine and release workflows and investigates suspicious campaigns. If a legitimate message is held, a user or administrator can release it, and FirstNet adjusts the rules so the same sender is handled correctly in future. Telling FirstNet about critical senders, such as key suppliers or payment platforms, during onboarding helps the baseline policy start in the right place. URL: https://www.firstnet.co.za/knowledge/security/will-a-new-email-security-layer-block-legitimate-email/. Reviewed 2026-10-10. #### Will enforcing DMARC with FirstNet's SendMarc service break our marketing email? Not with a phased approach. FirstNet identifies and authenticates every legitimate sending source before enforcement, moves your policy through quarantine with rollback guardrails, and only then reaches reject, so legitimate marketing and transactional email keeps flowing. The managed journey works like this: - FirstNet publishes a monitoring-only DMARC record (p=none) and collects reports from receiving mail providers - Every sending source is classified as legitimate, a forwarder or unauthorised; most organisations find 15 to 40 sources, including marketing platforms, ERP and finance systems - FirstNet engineers specify SPF and DKIM alignment for each legitimate platform, your administrators make the changes, and FirstNet validates them - Policy moves to p=quarantine, then p=reject, with go or no-go reviews at each step - Monthly managed-service reviews pick up new senders, such as a newly adopted marketing tool, so they can be authenticated Moving to p=reject too quickly is what breaks email, because most organisations have more legitimate senders than they realise. Gating each step on full source authentication removes that risk. Engage your marketing platform owners early, because their changes set the pace. URL: https://www.firstnet.co.za/knowledge/security/will-enforcing-dmarc-break-our-marketing-email/. Reviewed 2026-10-10. #### Will turning on Cloudflare's WAF through FirstNet break our applications? Not if it is staged properly. FirstNet stages the Cloudflare WAF in detection mode first and tunes it against your real traffic before enforcement. It documents a rollback path with your application team, and cutover stays reversible until enforcement. How FirstNet onboards the WAF: - Discovery and a phased design aligned with Cloudflare's technical account team - Domains onboarded and DNS applied, with baseline managed rulesets in detection mode - False positives reviewed against real traffic and rules tuned - Rules tightened and enforcement switched on once the baseline is clean - Ongoing false-positive triage and attack-event reviews after go-live Change windows and acceptance criteria are agreed with you before cutover, and the result is validated against them with your technical contact. The WAF covers managed rulesets, custom rules, OWASP Top 10 coverage, virtual patching and exposed-credential checks. Because Cloudflare depends on DNS or BGP pointing at its edge, FirstNet also documents fallback procedures aligned with your existing DNS playbook. Tell FirstNet about fragile or legacy applications during discovery so they get extra testing before enforcement. URL: https://www.firstnet.co.za/knowledge/security/will-turning-on-the-waf-break-our-applications/. Reviewed 2026-10-10. #### With a FirstNet managed firewall, what does FirstNet manage and what remains our responsibility? FirstNet manages the firewall itself: setup, policy, firmware and signature updates, monitoring, approved changes and incident response. You stay responsible for your internal LAN, endpoints, cabling, ISP handoffs and apps, and for giving accurate inputs. The split applies to every FirstNet managed firewall, Fortinet or Sophos, at your site or hosted on FirstNet's platform, with 8x5 or 24x7 support through Rapid Response. Agreeing it at the start avoids gaps after go-live. What FirstNet manages, within the contracted scope: - The firewall platform, its setup and the applying of policy - Firmware and signature updates, with a quarterly firmware programme on Fortinet estates run through FortiManager - Monitoring, tuning and regular posture reviews - Approved changes, with testing and rollback plans - Incident response - For hosted firewalls, the hosting platform as well - Monthly summaries, change records and improvement actions What remains your responsibility: - Approving scope, design inputs and changes through your authorised technical contacts - Supplying correct rules, NAT and routing needs, VPN peer details, certificates, addressing and ISP details - Owning those items, plus your internal LAN, endpoints, cabling, ISP handoffs, local switching and applications, unless agreed separately - Your overall compliance position and governance Changes follow a controlled process. Only your authorised technical contacts can request and approve them. Standard moves, adds and changes within the agreed policy framework are part of the managed service. Emergency, after-hours and major design changes, such as new VPNs, SD-WAN topology changes or large policy refactors, need explicit approval and may be scoped separately. Some work sits outside the standard service. Onsite hands-and-feet support is not included, and full network redesigns, security audits and penetration tests are scoped as separate work. With Sophos, incident response on your endpoints is out of scope unless you contract Sophos MDR, which can be added to a Sophos firewall on the same monthly bill for 24/7 detection. Visibility is not the same as shared administration. Read-only access is available on request through Sophos Central or a read-only FortiManager ADOM profile, so your team and auditors can see configuration and logs. Write access to production is an exception that needs explicit approval, because it changes the managed-service operating model. If your team needs hands-on administration, raise it during contracting. FirstNet gathers the inputs it needs during discovery: - Users, devices, sites and expected growth over 12 to 36 months - Peak inspected throughput and how much traffic needs SSL inspection - ISP handoff, circuit, public IP and failover details - Subnets, VLANs, routing, NAT and VPN peers - Firewall policy needs, authorised contacts, approvers and maintenance windows Getting these right up front is what lets FirstNet run the firewall cleanly from day one. URL: https://www.firstnet.co.za/knowledge/security/what-does-firstnet-manage-and-what-remains-our-responsibility-with-a-managed-fir/. Reviewed 2026-10-11. ### Voice #### Are FirstNet business voice minutes suitable for small and medium businesses? Yes. SMBs can start on low-commitment plans, such as pay-as-you-go minutes, and scale usage as the business grows without changing their infrastructure. FirstNet's voice platform supports five users or five thousand without architectural changes. Why it works for smaller businesses: - No long-term commitment is needed for pay-as-you-go minutes. - Minutes work with cloud PBX systems, softphones and hybrid teams, for both inbound and outbound calls. - Per-second billing means short calls are not rounded up to full minutes. - SIP channels are sized to peak concurrent calls, not headcount, so a 50-person business may need only a fraction of that in simultaneous calls. - Fraud controls, including anomaly detection, destination blocking and spending controls, protect against unexpected charges. For a single-site business, one SIP trunk suits non-critical voice where moderate downtime is acceptable. If you also take FirstNet connectivity, a free backup SIP trunk adds automatic failover. Businesses that would rather not run a phone system at all can choose FirstNet Managed Cloud PBX instead, which combines the PBX, numbers, softphones and calling into one managed service on one bill. URL: https://www.firstnet.co.za/knowledge/voice/are-voice-minutes-suitable-for-smbs/. Reviewed 2026-10-10. #### Can FirstNet AI Receptionist book appointments or update our CRM? Not as standard, but it can be scoped. Out of the box, FirstNet AI Receptionist answers, routes, escalates, transcribes and triggers voicemail-to-email or callback flows. Deeper actions such as calendar bookings or CRM updates are scoped per customer during setup. What it does out of the box: - Answers calls 24/7 in natural language, using your own knowledge base. - Routes calls by intent to menus, queues or extensions. - Escalates complex or sensitive calls to a human agent in Linkus. - Captures callbacks and triggers voicemail-to-email. - Produces a transcript and AI summary for every call. Separately, FirstNet Managed Cloud PBX offers CRM integrations with HubSpot, Salesforce and similar systems as add-ons. With AI Transcription, the call summary can sit alongside the call record for follow-up, which covers many follow-up needs without the AI Receptionist writing to the CRM itself. If you need the AI Receptionist to act inside another system, such as booking a slot or updating a customer record, FirstNet's voice engineers scope it during design, together with routing, escalation rules and the knowledge base. Custom call flows and integrations are handled as separately scoped change requests, so you know exactly what is included before you commit. URL: https://www.firstnet.co.za/knowledge/voice/can-the-ai-receptionist-book-appointments-or-update-our-crm/. Reviewed 2026-10-10. #### Can FirstNet Apex BI Clarity allocate telecom costs to departments? Yes. Clarity supports chargeback models with flexible tagging and reporting, so telecom spend can be allocated by department, cost centre, project, site or extension and recharged fairly to business units. How chargeback is set up: - You agree your cost-centre model with FirstNet at the start. - Call data flows in from your PBX CDR feed and, for Teams, the Microsoft Graph API. - Dashboards are built and chargeback rules calibrated with a pilot team or department. - Reporting is tuned over 2 to 4 weeks after data starts flowing. - Supervisors and finance are trained, then the service is rolled out fully. The same chargeback model applies wherever a call is made, across FirstNet Hosted PBX, legacy PBXs and Microsoft Teams, which keeps recharges consistent during a PBX-to-Teams migration. Scheduled reports keep budget holders informed, and threshold alerts and exception reports help prevent bill shock before month-end. The result is a chargeback process that finance can audit. If you also want mobile voice and data costs in the same allocation, the adjacent Clarity for Mobile module covers them, and Clarity for IoT gives visibility of the costs assigned to sensors and trackers. URL: https://www.firstnet.co.za/knowledge/voice/can-we-allocate-costs-to-departments/. Reviewed 2026-10-10. #### Can FirstNet Apex BI Clarity report on Microsoft Teams calls? Yes. Clarity for MS Teams uses the Microsoft Graph API to report on inbound and outbound PSTN calls, call duration, abandonment, agent activity and cost-centre chargeback, going deeper than Teams' built-in call reporting. It works whether you call through Operator Connect, Direct Routing or Microsoft Calling Plans. What it adds beyond Teams' native reports: - Chargeback of Teams call costs by department, cost centre, project or site. - Inbound and outbound PSTN volumes, duration and abandonment patterns. - Agent activity and queue statistics for customer-facing teams. - Live wallboards for supervisors. - Audit-grade reporting for POPIA, FSCA, healthcare and education programmes. Microsoft's built-in Teams reporting focuses on basic call quality and per-user volumes, so on its own it does not produce cost-centre chargeback or contact-centre wallboards. Set-up is light: your Microsoft 365 Global Admin grants Graph API permissions once during onboarding, and reports are tuned over 2 to 4 weeks after data starts flowing. Clarity for MS Teams is licensed per user. If part of your business still runs a PBX, Clarity combines both data sources in one tenant. URL: https://www.firstnet.co.za/knowledge/voice/can-we-report-on-microsoft-teams-calls/. Reviewed 2026-10-10. #### Can FirstNet Apex BI Clarity show PBX and Teams calls in one report? Yes. Where you run a PBX at some sites and Microsoft Teams at others, Clarity combines PBX call records and Teams Graph API data in a single Apex BI tenant. You get one view, one chargeback model and the same dashboards wherever a call was made or answered. Why a single view matters: - Vendor portals usually report per PBX and per site, and do not normalise data across a mixed estate. - Finance gets one recharge process instead of reconciling separate reports. - Reporting stays consistent while users move from a PBX to Teams in phases. - Managers compare sites and teams on the same measures, whatever platform they use. Supported sources include FirstNet Hosted PBX (native feed), legacy PBXs where CDR or SMDR data is available, and Microsoft Teams on Operator Connect, Direct Routing or Calling Plans. A mixed estate needs both the PBX feed and Graph API access, and FirstNet's voice engineers scope both before you commit. This suits multi-site retail, professional services and logistics businesses, and any organisation partway through a PBX-to-Teams migration. FirstNet can also deliver the voice on both sides, with Managed Cloud PBX, SIP trunks or Teams calling, so the analytics and the voice sit on one contract. URL: https://www.firstnet.co.za/knowledge/voice/can-we-see-pbx-and-teams-calls-in-one-report/. Reviewed 2026-10-10. #### Can FirstNet Compliance Recording remove card or health data from call recordings? Yes. The Conversation Analytics tier of FirstNet Compliance Recording includes automated redaction of PCI card data, personal information (PII) and health information (PHI) from both the audio and the transcripts. Redaction is automatic, so sensitive details such as card numbers read out during a payment are removed or masked without someone having to listen to and edit each call. This matters because PCI-DSS applies wherever cardholder data is handled, including over recorded phone lines, and because POPIA and health privacy rules limit how personal and health information is kept and who sees it. Conversation Analytics builds on Advanced Recording and also adds multilingual transcription, summarisation, sentiment and voice analysis, automated QA scorecards and dashboards. Core and Advanced Recording do not include redaction, so the tier should match a clear redaction or analytics need. Different parts of your business can sit on different tiers, for example Conversation Analytics for a contact centre that takes card payments and Core for office users. Redaction suits contact centres that take payments, financial services firms and healthcare contact centres. FirstNet enables it during onboarding, after capture has been connected and tested end to end on every platform in scope. URL: https://www.firstnet.co.za/knowledge/voice/can-sensitive-card-or-health-data-be-removed-from-recordings/. Reviewed 2026-10-10. #### Can FirstNet Managed Cloud PBX integrate with our CRM? Yes. CRM integrations with HubSpot, Salesforce and similar systems are available as add-ons to FirstNet Managed Cloud PBX, alongside contact-centre reporting and wallboards. Custom integrations are scoped by FirstNet's voice engineers during design. How CRM integration fits with the other features: - Standard CRM integrations connect your phone system and CRM as an add-on to the core service. - With AI Transcription, the call summary of topics, decisions and action items can sit alongside the call record for follow-up. - AI Receptionist actions inside a CRM, such as updating records or booking calendar slots, are scoped for each business rather than offered as standard. - Custom call flows, integrations and report development are handled as separately scoped change requests. If you need analytics beyond standard reporting, FirstNet Apex BI Clarity adds near real-time call analytics, wallboards, leaderboards and scheduled reports on top of the Managed Cloud PBX. To scope an integration quickly, note which CRM and version you use, which teams need it and what should happen in the CRM when a call starts or ends. FirstNet's voice engineers use this to confirm what is standard, what needs a change request and what is included before you commit. URL: https://www.firstnet.co.za/knowledge/voice/can-a-cloud-pbx-integrate-with-our-crm/. Reviewed 2026-10-10. #### Can FirstNet Teams Operator Connect handle lift lines, paging or fax? Not currently. Operator Connect does not support analogue devices through ATAs, which covers most lift lines, paging and fax, and it does not yet support common area phones or meeting room devices. FirstNet adds Direct Routing alongside Operator Connect in the same Teams tenant for these. How the mixed design works: - Most users stay on Operator Connect, with numbers managed in the Teams Admin Center and no SBC to run. - Analogue devices such as lift lines, paging and fax connect through FirstNet's Direct Routing SBCs, which handle them with SBC-side routing. - Common area phones in reception, lobbies or warehouses, and meeting room devices, also use Direct Routing. - Both run in the same Teams tenant, on FirstNet's ICASA-licensed network, with one support path. These limits come from Microsoft's published Operator Connect roadmap, so FirstNet identifies them during discovery rather than after go-live. FirstNet's voice engineers scope your analogue inventory, including each lift, paging zone and fax line, in the design phase so every device has a planned path. Direct Routing can also coexist with an on-premises PBX, so some legacy endpoints can stay on the existing system during migration. URL: https://www.firstnet.co.za/knowledge/voice/can-operator-connect-handle-our-lift-lines-paging-or-fax/. Reviewed 2026-10-10. #### Can FirstNet Truecaller for Business manage hundreds of business numbers? Yes. One verified brand profile applies consistently across all your authorised numbers, and FirstNet handles additions and changes as part of the managed service, so large estates do not need a separate set-up per number. How large number estates are handled: - One brand profile, with name, logo, category tag and business page, is applied to every authorised outbound number. - Call reasons can be mapped per number or use case, for example collections lines and delivery lines. - Dynamic reasons can be passed per call from your CRM or dialler through the Truecaller API. - Large estates across regions or business units, especially with dynamic reasons, start with a technical workshop before timelines are committed. - New numbers, branding updates and call-reason changes go through FirstNet's change control. To get started, FirstNet confirms the caller IDs in scope, your priority numbers and key contacts, then verifies ownership and business registration. A pilot on one or two priority numbers comes first, followed by rollout across the rest of the estate and a review after 30 to 90 days. Proof of ownership is needed for every number you want verified, so an up-to-date list of numbers, and the entity that holds each one, speeds up onboarding. URL: https://www.firstnet.co.za/knowledge/voice/can-we-manage-hundreds-of-numbers/. Reviewed 2026-10-10. #### Can FirstNet migrate our contact centre from Genesys, Avaya or Mitel to Zoom? Yes. FirstNet captures your current queues, IVR, CRM integration and recording set-up, designs the Zoom Contact Centre equivalent, pilots a representative agent group in parallel and cuts over with a rollback plan. How a migration runs: - Discover: current platform, agent count, sites, channel mix, CRM and compliance requirements. - Design: queue and IVR workshops covering call flows, after-hours handling, overflow, call-back, language routing and priorities, plus CRM integration and porting scope. - Provision: FirstNet is enabled on your Zoom tenant through the Provider Exchange, numbers are provisioned, queues and IVR are built and CRM connectors configured. - Pilot and parallel run: a pilot agent group runs alongside your current platform, with end-to-end test calls, CRM screen-pop checks and recording and reporting validated. - Cutover and hyper-care: numbers port across, remaining agents move, training is delivered and FirstNet monitors the first 30 days. The same approach applies to in-house IVRs and other legacy platforms. Typical implementations take 6 to 12 weeks, depending on agent count, channels, integrations and porting. Agents and supervisors are trained before go-live, with a train-the-trainer option. If you already use Zoom for meetings, back-office staff can move to Zoom Phone on the same platform, with warm transfers between the two. URL: https://www.firstnet.co.za/knowledge/voice/can-we-migrate-from-genesys-avaya-or-mitel/. Reviewed 2026-10-10. #### Can FirstNet migrate recordings from our old on-premises call recorder? Yes. FirstNet offers a once-off compliant migration of historical recordings from existing on-premises recorders, with chain of custody preserved. It can be added to any FirstNet Compliance Recording set-up. How a migration is approached: - Discovery captures the legacy recorder vendor, its contract end date, the recordings to move and any deadline. - Large or complex migrations, such as several recorders, high data volumes or a regulator deadline, start with a technical workshop before timelines are committed. - Recordings move with chain of custody preserved, so there is a record that they were not altered along the way. - Migrated recordings join the same tamper-proof archive as new calls, under one retention policy, one search and one audit trail. The migration is scoped as a once-off professional services engagement, sized per source recorder and data volume, separate from the recording subscription. In the standard onboarding sequence it follows the connection and testing of capture on your live platforms, so new calls are protected first. Migrating helps businesses retire legacy recorders that face hardware end-of-life, offer no remote or mobile capture and carry expensive storage, while keeping their historical recordings retrievable for audits and disputes. URL: https://www.firstnet.co.za/knowledge/voice/can-we-move-recordings-from-our-old-call-recorder/. Reviewed 2026-10-10. #### Can FirstNet run Microsoft Teams calling for some users and a PBX or Zoom for others? Yes. Hybrid voice designs are common with FirstNet. Operator Connect and Direct Routing can run in the same Microsoft Teams tenant, and FirstNet SIP Trunks can stay under an existing PBX while other users move to Teams or Zoom Phone. Typical hybrid patterns: - Most Teams users on Operator Connect, with Direct Routing alongside in the same tenant for devices Operator Connect does not support, such as common area phones, meeting room devices and analogue lift lines, paging or fax. - An existing SIP-compliant PBX kept on FirstNet SIP Trunks while selected users move to Zoom Phone, with dial plans and emergency routing aligned. - Microsoft Teams as the user interface, with FirstNet Managed Cloud PBX running queues, IVR and recording underneath. - SIP trunks running under a legacy PBX while Teams calling rolls out, followed by a full transition later. Because every option runs on FirstNet's own ICASA-licensed network, numbers, porting and support stay with one provider. Reporting can follow the same mix: Apex BI Clarity combines PBX call records and Teams calling data into one view and one chargeback model, which helps during a phased PBX-to-Teams move. A FirstNet voice specialist can design the coexistence plan for your sites. URL: https://www.firstnet.co.za/knowledge/voice/can-i-mix-platforms-for-example-teams-for-some-users-and-a-pbx-for-others/. Reviewed 2026-10-10. #### Can FirstNet run our call recording platform for us as a managed service? Yes, through the optional FirstNet Managed Compliance Service. FirstNet operates the recording platform on your behalf, covering policy configuration, retention administration, legal hold, user provisioning and audit-evidence support, plus regular compliance reviews with your compliance or risk lead. Who it suits: - Organisations without the internal capacity to administer a recording platform. - Businesses with high audit exposure, where evidence must be ready on request. - Organisations that need strict separation of duties in how recordings are administered. Without the service, standard support is still included. FirstNet handles onboarding, configuration and ongoing platform support, while your own admins operate the platform day to day. The Managed Compliance Service can be added to any tier, from Core Recording to Conversation Analytics, as a recurring subscription. The service covers the recording archive itself. Administering your own PBX or identity provider is out of scope unless it is separately contracted. You log tickets through FirstNet's support channels by email, phone or portal, and FirstNet owns escalation of underlying CallCabinet and Smarsh platform incidents through to closure, so you deal with one provider. URL: https://www.firstnet.co.za/knowledge/voice/can-firstnet-run-the-recording-platform-for-us/. Reviewed 2026-10-10. #### Can I get SIP trunk redundancy from FirstNet without using FirstNet connectivity? Yes. The free backup SIP trunk applies when you also take FirstNet connectivity, but standalone SIP customers can add a backup trunk as a separate line item. For the most critical sites, FirstNet can also design dual-carrier diversity with documented failover. The three continuity levels: - Single primary trunk: suits single-site or non-critical voice where moderate downtime is an accepted risk. - Primary plus backup trunk: if the primary loses signalling, calls reroute to the backup automatically with no manual intervention. Free with FirstNet connectivity, chargeable without it. - Dual-carrier diversity: for high-availability contact centres, treasury operations and mission-critical medical sites that genuinely need multi-vendor diversity. Both primary and backup trunks run on FirstNet's dual PortaOne clusters with zero-downtime updates. Bear in mind that a backup trunk protects against a trunk failure, not against an outage on your own internet link. If both trunks depend on one link, that link remains a single point of failure, which is why FirstNet pairs voice with diverse connectivity such as broadband or SD-WAN where uptime matters. FirstNet's voice engineers scope the right posture for each site. URL: https://www.firstnet.co.za/knowledge/voice/can-i-get-voice-redundancy-without-firstnet-connectivity/. Reviewed 2026-10-10. #### Can I keep my existing business phone numbers when I move to FirstNet voice? Yes. FirstNet manages porting of your geographic and non-geographic numbers end to end, using a Letter of Authority (LoA) that you sign. A typical port takes 5 to 15 business days, depending on the losing carrier. How a port works: - FirstNet captures the numbers and ranges to move, your current operator and your caller ID presentation rules. - You sign the LoA, which FirstNet prepares and submits to your current (losing) carrier. - The losing carrier accepts, queries or rejects the request. Queries usually come from address or account holder mismatches, or numbers tied to other services. - A low-traffic cutover window is agreed with a rollback option, and FirstNet provisions the numbers in parallel. - After cutover, FirstNet monitors calls for the first 24 hours and confirms with you. Large blocks, multi-site or multi-carrier consolidations usually take 3 to 6 weeks. FirstNet does not control how quickly the losing carrier responds, so it does not guarantee dates that depend on another operator. Accurate account details and a promptly signed LoA avoid most delays, and numbers can be ported out again later, so you are not locked in. URL: https://www.firstnet.co.za/knowledge/voice/can-i-keep-my-existing-phone-numbers/. Reviewed 2026-10-10. #### Can I migrate from my legacy PBX to FirstNet Managed Cloud PBX? Yes. FirstNet manages the whole move from a legacy PBX, including number porting, configuration and a phased rollout to minimise disruption. Migration paths cover on-premises PBXs, 3CX, Mitel and similar systems. The migration sequence: - Design: FirstNet's voice engineers scope users, sites, numbers, integrations, any Teams use and the cutover approach. - Port: geographic and non-geographic numbers are ported end to end by FirstNet, and the cutover plan is signed off with you. - Deploy: Linkus apps are rolled out, IVR, queues and recording are configured, any AI add-ons are trained, and user acceptance testing is completed. - Operate: handover to a named support team with documented runbooks. You choose between two cutover styles. A side-by-side cutover runs old and new systems in parallel while users move in waves, which suits larger or more complex estates. A big-bang cutover moves everything in a single weekend or after-hours window, which suits smaller sites. Before cutover you will need a finalised user list, a signed Letter of Authority for your numbers, an agreed change window and phones or softphones ready for day one. If your current PBX still has life in it, FirstNet SIP Trunks can connect it instead. URL: https://www.firstnet.co.za/knowledge/voice/can-i-migrate-from-my-legacy-pbx/. Reviewed 2026-10-10. #### Can I use my mobile phone as my office extension with FirstNet Managed Cloud PBX? Yes. The Linkus mobile and desktop apps included with FirstNet Managed Cloud PBX let you make and receive calls on your business number from anywhere, whether you are in the office, on the road or working from home. Callers see the same office number. How it works in practice: - Install the Linkus app on your mobile phone or computer; softphone licences are included with each seat. - Calls reach you through the same queues, IVR and routing as a desk phone. - You call out on the business number rather than a personal mobile number. - Complex calls handed over by the AI Receptionist also land in Linkus, with the transcript and summary. This suits hybrid and distributed teams that no longer want phones tied to a desk, and multi-site businesses that want remote staff connected without complex VPNs. Call quality on a softphone depends on the connection it uses. Voice needs low latency, jitter and packet loss, so a stable Wi-Fi or mobile data connection gives the best results, and office networks should prioritise voice traffic with QoS. FirstNet checks the office side of this, including bandwidth headroom and firewall settings, before go-live. URL: https://www.firstnet.co.za/knowledge/voice/can-i-use-my-mobile-phone-as-my-office-extension/. Reviewed 2026-10-10. #### Can Microsoft Teams be used as a business phone system with FirstNet? Yes. With FirstNet Operator Connect or Direct Routing, Microsoft Teams becomes a complete business phone system: users make and receive external calls in Teams on desktop, mobile and web, with South African numbers and local support. What you need: - A Microsoft Teams Phone Standard or E5 licence for each user. FirstNet can supply Teams Phone licences as a Microsoft CSP. - A tenant in Teams-Only mode. - Someone with Global Admin access available for the integration window. - A connection to the phone network, through Operator Connect (no SBC to buy) or Direct Routing (FirstNet-managed SBCs). FirstNet adds local South African termination, number porting, local support and custom routing, and its services can coexist with Microsoft Calling Plans in one tenant. Deployment runs in five phases, prepare, plan, provision, pilot and production, with auto attendants, call queues and dial plans built before pilot users cut over. If you want fuller call-centre features behind Teams, FirstNet Managed Cloud PBX can run queues, IVR and recording underneath while Teams stays the front end your users already know. URL: https://www.firstnet.co.za/knowledge/voice/can-microsoft-teams-be-used-as-a-phone-system/. Reviewed 2026-10-10. #### Can Truecaller verified branding from FirstNet also be used on business SMS? Yes. Verified Message ID extends your verified brand identity to SMS, for messages such as one-time PINs, payment alerts, delivery notices and appointment confirmations. It is available in the CX Solution subscription and is usually added once verified caller ID is live. The wider engagement options: - Verified Message ID: your verified identity on SMS, so customers can recognise genuine OTPs and alerts. - Video Caller ID: a short branded video plays on the recipient's screen while the phone rings. - Call Me Back: customers who miss your call can choose a callback slot. - User Feedback: post-call ratings on missed, rejected and answered calls. These are typically added after the core verified caller ID has shown value, around the 30 to 90-day review, so you build on measured results rather than switching everything on at once. Using verified identity on both voice and SMS gives customers a consistent way to recognise you across channels. FirstNet scopes the SMS use cases with you, along with any integration needed, and manages the set-up as part of the same service, with changes and support handled by FirstNet rather than a separate vendor. URL: https://www.firstnet.co.za/knowledge/voice/can-verified-branding-also-be-used-on-business-sms/. Reviewed 2026-10-10. #### Can resellers and service providers buy bulk voice minutes from FirstNet? Yes. Resellers, MSPs and IT service providers can buy bulk voice minutes from FirstNet and build them into their own services, using white-label or API-based integration on FirstNet's carrier network. What resellers get: - Wholesale-grade minutes to build or expand their own SIP trunking, hosted PBX or UCaaS offering. - A trunk partner for clients whose PBX layer the reseller owns and manages. - API access to provision minutes, track usage and automate processes. - Live dashboards and analytics on consumption, rate classes, call patterns and cost forecasts. - Fraud controls, including anomaly detection, destination blocking and spending controls, to protect margins. Commercially, resellers typically use committed monthly bundles, with pricing based on traffic volume, destination mix and routing requirements. Specialised international routes are available for global termination. Calls terminate over FirstNet's ICASA-licensed network, with direct interconnects to Telkom, Vodacom, MTN, Cell C and other licensees, and multiple upstream interconnects for resilience and best-path routing. The platform scales from five users to five thousand without architectural changes. A FirstNet voice specialist can prepare a rate card based on your expected traffic profile. URL: https://www.firstnet.co.za/knowledge/voice/can-resellers-purchase-bulk-minutes/. Reviewed 2026-10-10. #### Can resellers sell FirstNet cloud PBX and voice under their own brand? Yes. Approved resellers sell FirstNet cloud PBX, SIP trunks and voice minutes under their own brand. FirstNet runs the network, porting and numbers behind them. Everything runs on FirstNet's own network and is supported by FirstNet, so you sell under your brand without building the platform. Voice runs on FirstNet's ICASA-licensed (ECNS/ECS) network, and the hosted PBX is the Yeastar P-Series platform from South Africa's number one Yeastar hosting partner. What resellers can offer: - Cloud PBX: hosted PBX and Microsoft Teams calling for your customers. - Voice minutes and SIP trunks: bulk minutes with white-label or API-based integration, to build your own SIP, PBX or UCaaS offering. - Number porting, and new numbers from FirstNet's registered ranges. - Connectivity and Veeam backup, if you want to sell more than voice. How to join: apply online with your company details, contacts and what you want to resell. A FirstNet partner manager confirms fit, pricing and onboarding. If you are approved, FirstNet emails a one-time activation link, you sign in with your own Microsoft work account, and new accounts start in practice mode. Day to day, the reseller portal is where the work happens. You submit port-in requests, send customers a secure single-use link to upload porting documents, request numbers and track the status and dates of every request. You see only your own requests and numbers, FirstNet operators review every document, and FirstNet does the network work. API access lets resellers provision minutes, track usage and automate processes, and fraud controls such as anomaly detection, destination blocking and spending controls help protect margins. URL: https://www.firstnet.co.za/knowledge/voice/can-resellers-sell-firstnet-cloud-pbx-under-their-own-brand/. Reviewed 2026-10-11. #### Can some users stay on our existing PBX while others move to Zoom Phone with FirstNet? Yes. Hybrid set-ups are common: FirstNet SIP Trunks stay under your existing PBX while selected users move to Zoom Phone, with dial plans and emergency routing aligned across both. How a hybrid design is scoped: - Decide which users move to Zoom Phone and which stay on the PBX. - Keep the PBX on FirstNet SIP Trunks, so both platforms run on FirstNet's ICASA-licensed network. - Align dial plans so users on either platform can reach each other. - Align emergency routing so emergency calls work correctly from both platforms. - Plan which numbers stay with the PBX and which move to Zoom. This works with PBXs such as Yeastar as well as other SIP-compliant systems. Users who stay on the PBX can move later in waves without changing the voice provider underneath. FirstNet's voice engineers scope the boundary between the two platforms, how the SIP underlay is shared and the porting plan. A pilot group goes live on Zoom Phone first, with hyper-care during cutover, and the remaining users follow once the pilot is accepted. Legacy carrier traffic is then retired on a documented date, so nothing is left running by accident. URL: https://www.firstnet.co.za/knowledge/voice/can-some-users-stay-on-our-existing-pbx/. Reviewed 2026-10-10. #### Can the FirstNet Smartz contact centre work with Microsoft Teams? Yes. Microsoft Teams Phone stays your dial tone, and Smartz connects over SIP or Direct Routing to add what Teams lacks for a contact centre: skills-based routing, a full dialler suite, messaging channels, QA, voice biometrics and live wallboards. A Teams calling licence is still required. What the combination looks like: - Teams Phone can run on FirstNet Operator Connect or Direct Routing, or on Microsoft Calling Plans. - Smartz Commz adds the ACD, IVR, queues and outbound diallers, plus SMS, WhatsApp, web chat, email, Telegram and Meta Messenger in the Chatterbox agent desktop. - Smartz Engage adds audit-grade QA, time and attendance and e-learning for the contact-centre team. - Smartz Analyz adds near-real-time wallboards, more than 25 dashboards and CSAT, NPS and CES reporting. Before go-live, FirstNet's Voice Solutions Engineering team confirms the Direct Routing or SIP path into Smartz and tests the Teams integration end to end. Your Global Admin grants Microsoft Graph consent during onboarding where Teams is in scope. Teams Phone, the Smartz Suite and add-ons such as Apex BI Clarity call analytics or compliance recording can all sit on one FirstNet contract, with one escalation path. URL: https://www.firstnet.co.za/knowledge/voice/can-the-smartz-contact-centre-work-with-microsoft-teams/. Reviewed 2026-10-10. #### Can the Truecaller for Business call reason change for each call? Yes. With FirstNet Truecaller for Business, static call reasons such as "Payment reminder" or "Delivery update" are set per number or use case at onboarding and suit most outbound teams. Dynamic call reasons are sent at dial time from your CRM, dialler or contact-centre platform, so each call can carry a customer-specific or campaign-specific reason. How the two options compare: - Static reasons: a small set mapped per number or use case, enough for most collections, delivery and appointment calls. FirstNet changes them on request. - Dynamic reasons: your system passes a per-call reason through the Truecaller API or a webhook, with end-to-end authentication. - Typical dynamic uses: personalised collections, claim-specific updates and campaign-specific messages. - Integration: dynamic reasons are scoped as an integration project, with a technical workshop for complex or large deployments. The recommended starting point is static reasons on one or two priority numbers, measured in a pilot, with dynamic reasons added where the business case is clear. Keep reasons short and relevant, and consider whether a reason could reveal personal details on a recipient's screen, because call-reason content shapes POPIA outcomes. The analytics dashboard shows how answer rates change as reasons are refined. URL: https://www.firstnet.co.za/knowledge/voice/can-the-call-reason-change-for-each-call/. Reviewed 2026-10-10. #### Can we port our numbers out of FirstNet Managed Cloud PBX if we leave? Yes. Geographic and non-geographic numbers can be ported both in and out of FirstNet Managed Cloud PBX, and the service is built on standards-based SIP, so you are not locked in to FirstNet. What protects you from lock-in: - Full number porting in and out, handled through a Letter of Authority under South Africa's number portability regulations. - Standards-based SIP underneath, rather than a proprietary calling protocol. - Numbers held by an ICASA-licensed operator, because FirstNet holds ECNS and ECS licences. - Contract terms of 12, 24 or 36 months, with per-user billing aligned to the users actually licensed each month. When you move numbers to another provider, the request runs through a Letter of Authority with FirstNet as the losing carrier. Port timelines typically run 5 to 15 business days, depending on range size and whether the numbers are tied to other services, and larger multi-site ranges can take longer. The same porting process works in the other direction, which is how most customers arrive: FirstNet ports existing numbers in end to end, monitors calls for 24 hours after cutover and keeps your callers dialling the numbers they already know. URL: https://www.firstnet.co.za/knowledge/voice/can-we-port-our-numbers-back-out-if-we-leave/. Reviewed 2026-10-10. #### Can we record Zoom Phone calls for FSCA or POPIA compliance with FirstNet? Yes, through FirstNet Compliance Recording, which integrates with Zoom using CallCabinet, powered by Smarsh. Recorded Zoom Phone users need the Zoom Phone Power Pack licence. The platform supports your compliance programme, but compliance itself depends on your own policies. What compliance recording adds for Zoom: - Capture of Zoom Phone, Zoom Meetings and Zoom Contact Center into one tamper-proof archive. - AES-256 rotating encryption, MFA and granular, role-based permissions. - Retention policies, legal hold, defensible deletion and audit logs. - Optional QA workflows, transcription, sentiment and automated PCI, PII and PHI redaction. During design, FirstNet scopes the recorded user list, retention period, search and supervisor access, and audit requirements. POPIA also expects a consent prompt on recorded lines, which is configured and tested during activation. Native Zoom recording is useful day to day, but it lacks the tamper-proof storage, granular retention, legal hold and audit logs that audits and disputes rely on. Only users whose calls must be recorded need the Power Pack, not everyone. If your business also uses Teams or a PBX, the same archive and policy can cover those calls too. URL: https://www.firstnet.co.za/knowledge/voice/can-we-record-zoom-phone-calls-for-fsca-or-popia/. Reviewed 2026-10-10. #### Can we test FirstNet SIP trunks before switching from our current voice carrier? Yes. FirstNet can run a small SIP trunk in parallel into your existing PBX, so you can prove call quality before staging the full migration at your own pace. Your current carrier stays in place until you are ready to move. How a parallel trial and migration usually run: - Prepare: PBX firmware and SIP-compliance review, a firewall and NAT walkthrough and an IP whitelist plan. - Plan: channel sizing, codecs, backup trunk sizing, porting scope and an agreed cutover and rollback plan. - Provision: FirstNet sets up trunks, numbers and the voice plan, and your PBX is configured with FirstNet runbook support. - Pilot: end-to-end test calls (inbound, outbound, transfer, hold and internal), caller ID checks, backup failover tests and a pilot group of users or sites. - Production: number porting cutover, the remaining users, monitoring and tuning, then handover to ongoing support. After cutover, FirstNet's service delivery team provides 30 days of post-cutover hyper-care. Part of your old estate can also keep running alongside during migration, which suits businesses moving off copper lines or legacy PBXs in stages. URL: https://www.firstnet.co.za/knowledge/voice/can-we-test-before-switching-from-our-current-carrier/. Reviewed 2026-10-10. #### Can we use Teams calling with FirstNet while keeping our current voice carrier contract? Yes. FirstNet Teams Direct Routing is carrier-agnostic, so FirstNet's managed SBCs can sit on top of your existing SIP environment while your carrier relationship stays in place. Users get Teams calling now, without waiting for the carrier contract to end. How it works: - FirstNet connects your Teams tenant to Microsoft-certified SBCs that it owns and manages, so there is no SBC to buy. - The SBCs route calls out through your existing carrier's SIP trunk, or through FirstNet's own trunk if you choose. - Signalling is encrypted with TLS 1.2 and media with SRTP. - Custom routing, such as location-based rules and custom dial plans, is designed against your tenant. When the carrier contract comes up for renewal, you can move the trunk to FirstNet SIP termination and port your numbers with a signed Letter of Authority, without changing how users call in Teams. Keep in mind how support is split. FirstNet's SLA covers what it manages: the SBC platform, its own SIP trunk, number provisioning and support. A third-party carrier you keep sits outside that SLA. FirstNet still acts as the single point of escalation for the Teams calling service, including joint escalation with Microsoft. URL: https://www.firstnet.co.za/knowledge/voice/we-have-a-long-running-carrier-contract-can-we-still-use-teams-calling/. Reviewed 2026-10-10. #### Do I need to change my firewall settings for VoIP calls with FirstNet? Usually yes. For VoIP to work reliably, SIP ALG must be switched off on your firewall and the RTP media ports must be open. FirstNet checks both as part of its readiness review before any voice service goes live. Why these settings matter: - SIP ALG (Application Layer Gateway) is enabled on many small-business firewalls. It alters call signalling, which typically causes failed calls or one-way audio. - RTP carries the voice itself. If the RTP port range is blocked or restricted, calls may connect but the audio is cut. - Symmetric NAT can also disrupt calls, so FirstNet runs a NAT type test to flag it. Before go-live, FirstNet records your firewall make, model and firmware, confirms SIP ALG is disabled and tests the NAT type. For SIP trunks, the plan also covers port and IP whitelisting, NAT traversal and whether a session border controller is needed for an older PBX. Where your PBX supports it, FirstNet SIP Trunks use SIP over TLS for signalling and SRTP for media encryption. If your current firewall cannot be set up correctly, FirstNet can supply a managed firewall service from Sophos or Fortinet. URL: https://www.firstnet.co.za/knowledge/voice/do-i-need-to-change-my-firewall-for-voip-calls/. Reviewed 2026-10-10. #### Do we need to tell callers that calls are recorded under POPIA? Yes. POPIA sets out consent and retention requirements, so recorded lines should play a consent or disclosure prompt before the conversation starts. With FirstNet Compliance Recording, the consent prompt is configured and tested as part of activation, and a sample of calls is checked in the first week after go-live. Decisions to settle before go-live: - Whether to record all calls, only some lines or call types, or none. - How long each type of recording must be kept; five years is common for FSCA and FAIS advice calls. - Who may access recordings and under what conditions. - Whether sensitive data such as card numbers should be redacted. The prompt is normally an IVR message that plays before the call connects. Recording without one can breach POPIA, and that liability sits with the business doing the recording. Integrations also support consent workflows, disclosure prompts and export of recordings for investigations or training. The same applies to any recorded line, including the call recording built into FirstNet Managed Cloud PBX, not only compliance recording. FirstNet's services support your compliance programme, but your own policies and configuration decide the final outcome. URL: https://www.firstnet.co.za/knowledge/voice/do-we-need-to-tell-callers-that-calls-are-recorded/. Reviewed 2026-10-10. #### Does FirstNet AI Receptionist replace our human receptionist? No. FirstNet AI Receptionist is designed as the 24/7 layer behind your front desk, not a replacement for it. Use it for after-hours, overflow, holiday cover and high-volume routing, while your receptionist handles the relationship calls. Where it adds the most value: - After hours: calls are answered, understood and routed or captured instead of going straight to voicemail. - Overflow: when the front desk is busy, the AI Receptionist picks up so callers are not left waiting. - Holiday cover: the line stays answered when staff are on leave. - High-volume routing: common requests go straight to the right queue or extension. - Multilingual callers: it supports 34 languages with a customisable voice, tone and persona. Complex or sensitive calls escalate to a human agent in Linkus, with the transcript and AI summary attached, so your team picks up with full context. The practical result is that you keep your receptionist and stop missing calls outside their hours. It runs on FirstNet Managed Cloud PBX and is set up in four steps: create the AI Receptionist extension, customise the voice and persona, train it on your knowledge base, then test and publish. URL: https://www.firstnet.co.za/knowledge/voice/does-the-ai-receptionist-replace-our-receptionist/. Reviewed 2026-10-10. #### Does FirstNet Apex BI Clarity alert us to unusual telecom usage? Yes. Clarity uses thresholds and anomaly detection to highlight unusual usage quickly, with threshold alerts and exception reports designed to prevent bill shock across your PBX and Microsoft Teams calling. What the alerts and reports help you catch: - Spend that crosses a threshold you set, by department, cost centre, site or extension. - Out-of-policy usage, such as calls that break your telecom rules. - Mis-billed extensions and under-used services or lines. - Unusual trends in call activity, through trend visibility across PBX and Teams. Alerts and dashboards keep stakeholders informed, and scheduled reports go to the people who need them. Policy enforcement rules help reduce misuse and risky behaviour, and role-based access keeps that governance auditable. Customers commonly find recoverable spend this way, although FirstNet does not promise a fixed saving; the first month's report quantifies it for your estate. Where Clarity for Mobile is added, the same bill-shock controls extend to mobile voice and data. Clarity works alongside the network-level fraud controls on FirstNet voice services, such as automated anomaly detection, destination blocking and spending controls, so unusual traffic is caught both in the network and in your reporting. URL: https://www.firstnet.co.za/knowledge/voice/do-you-provide-alerts-for-unusual-usage/. Reviewed 2026-10-10. #### Does FirstNet Truecaller for Business work with our existing phone system? Yes. FirstNet Truecaller for Business works with your existing outbound numbers regardless of voice platform, and pairs natively with FirstNet hosted PBX and contact-centre solutions. It is a presentation and trust layer on top of your voice service, not a replacement for it. How it fits different set-ups: - Any PBX or carrier: verification is tied to your outbound numbers, so the underlying phone system does not need to change. - FirstNet Managed Cloud PBX, SIP trunks and Teams calling: Truecaller can be added to the same voice contract. - Contact centres and diallers: static call reasons work without integration, while dynamic reasons are passed per call from your CRM, dialler or contact-centre platform through the Truecaller API. - FirstNet Smartz Contact Centre: pairing the predictive dialler with verified caller ID lets customers see who is calling. What matters most is that you can prove ownership of the numbers you want verified, along with your business registration. FirstNet then applies one brand profile across all authorised numbers. One practical point: your phone system must present the verified number as the caller ID on outbound calls, because the brand only appears for numbers that have been verified. URL: https://www.firstnet.co.za/knowledge/voice/does-it-work-with-our-existing-phone-system/. Reviewed 2026-10-10. #### Does FirstNet guarantee POPIA or FSCA compliance for business voice and call recording? No. No provider can guarantee regulatory compliance on your behalf. FirstNet's recording and reporting services support your compliance programme for POPIA, FSCA and similar rules, but final compliance depends on your own policies, configuration and obligations. What FirstNet provides to support compliance: - FirstNet Compliance Recording captures Teams, Zoom, PBX and contact-centre calls into one tamper-proof archive with retention policies, legal hold and audit logs. - The recording platform supports compliance programmes for POPIA, FAIS, FICA, PCI-DSS, GDPR and other frameworks. - POPIA consent prompts on recorded lines are configured and tested as part of recording activation, with a sample of calls checked in the first week. - Apex BI Clarity keeps an immutable call-activity record that supports POPIA, FSCA, healthcare and education audits. What stays with you: deciding which calls to record, how long to keep them, who may access them and how consent is handled. Recording without a consent prompt, for example, can breach POPIA, and that liability sits with the business doing the recording. FirstNet's SLAs cover the components FirstNet manages, and a FirstNet specialist can help map your obligations to the right recording and reporting set-up. URL: https://www.firstnet.co.za/knowledge/voice/does-firstnet-guarantee-regulatory-compliance/. Reviewed 2026-10-10. #### Does FirstNet supply desk phones for its Managed Cloud PBX? Yes. FirstNet supplies Yealink and Polycom desk phones, and softphone licences are included with each Managed Cloud PBX seat if your team prefers to call from a computer or mobile phone. Desk phones suit reception, switchboards and fixed desks. They work best on network switches that provide Power over Ethernet (PoE); without PoE, every phone needs its own power adapter, which is untidy and harder to keep running during load-shedding. Before deployment, FirstNet audits your switch ports and checks the PoE power budget against the planned number of handsets, and can refresh LAN switching where the current switches fall short. Softphones are the Linkus mobile and desktop apps. They let staff make and receive calls on the business number from the office, on the road or at home, using the same queues and routing as a desk phone. This suits hybrid and distributed teams that no longer want phones tied to a desk. Whichever you choose, devices must be ready for day one: FirstNet confirms either a signed handset order with a delivery date or the number of softphone licences as part of planning, because no phones on day one means no voice on day one. URL: https://www.firstnet.co.za/knowledge/voice/does-firstnet-supply-desk-phones/. Reviewed 2026-10-10. #### Does Teams Operator Connect support common area phones and meeting room devices? Not yet. According to Microsoft's published roadmap, Operator Connect does not currently support common area phones, meeting room devices or analogue devices connected through ATAs. FirstNet uses Direct Routing for those devices, alongside Operator Connect in the same Teams tenant. Which path each device takes: - Named users on Teams desktop, mobile and web: Operator Connect, managed in the Teams Admin Center. - Common area phones in reception, lobbies or warehouses: Direct Routing. - Meeting room devices: Direct Routing. - Analogue devices such as paging, fax and lift lines through ATAs: Direct Routing, using SBC-side routing. This mixed design lets most users stay on the simpler Operator Connect service while the exceptions are handled properly. Both paths run over FirstNet's ICASA-licensed network, with FirstNet managing the SBCs and providing a single support channel for escalations, including joint escalations with Microsoft. FirstNet identifies these devices in the Plan phase, when user and device design decisions are made, so nothing is left unconnected at cutover. Because Microsoft's roadmap can change, FirstNet confirms current Operator Connect support for your device types at the time of design. URL: https://www.firstnet.co.za/knowledge/voice/does-operator-connect-support-common-area-phones-and-meeting-room-devices/. Reviewed 2026-10-10. #### Does Zoom Contact Centre from FirstNet integrate with Salesforce, HubSpot or ServiceNow? Yes. Zoom Contact Centre has native connectors for HubSpot, Salesforce and ServiceNow. FirstNet's implementation team configures the connector, screen pops, click-to-dial and outcome write-back to match your CRM. What the integration typically covers: - Screen pops that show the customer record when a contact arrives. - Click-to-dial from the CRM. - Outcome write-back, so call results are logged against the record. - Ticket creation where your process needs it. - Checks of screen-pop behaviour during the pilot, before cutover. Integration requirements are covered in the design stage together with queue and IVR design, so routing and CRM behaviour are planned as one. Integrations beyond these connectors, such as heavily customised CTI or proprietary IVRs without documented integration, are scoped carefully before you commit, because they add complexity and time. To scope quickly, share which CRM and ticketing systems you use, what supervisors expect to see, and whether API access is ready on the CRM side. If you need analytics beyond Zoom's native dashboards, Apex BI Clarity for Zoom Contact Centre adds queue, channel, agent and outcome reporting on the same FirstNet contract. URL: https://www.firstnet.co.za/knowledge/voice/does-zoom-contact-centre-integrate-with-salesforce-hubspot-or-servicenow/. Reviewed 2026-10-10. #### Does Zoom Phone work in South Africa, and how does FirstNet provide it? Yes. Zoom Phone works in South Africa through a Zoom Provider Exchange partner, because Zoom does not provide phone numbers in South Africa on its own. FirstNet is a certified Zoom Provider Exchange partner that supplies ICASA-licensed local numbers, porting, implementation and support for Zoom Phone and Zoom Contact Centre. How it works: - Zoom hosts the phone system and contact centre; your Zoom admin selects FirstNet as the voice provider, with no separate carrier portal. - FirstNet issues new geographic, non-geographic and toll-free numbers, or ports your existing numbers in. - Calls route over FirstNet's interconnects with Telkom, Vodacom, MTN, Cell C and other licensees. - Premium-rate and exotic destinations are blocked by default, and a 24/7 network operations centre monitors for toll fraud. - Zoom licences, voice and numbers come on one FirstNet invoice. Most users need a Zoom Phone Pro licence, supervisors add the Power Pack, and shared reception or warehouse phones use a Common Area licence. Local support is available in English and Afrikaans. Some users can also stay on an existing PBX through FirstNet SIP Trunks while others move to Zoom Phone. URL: https://www.firstnet.co.za/knowledge/voice/does-zoom-phone-work-in-south-africa/. Reviewed 2026-10-10. #### Does the FirstNet Smartz contact centre cover regulated call recording? Not on its own. Smartz records voice and agent desktops for quality and coaching. If you are regulated under FAIS, FSCA or similar regimes, FirstNet pairs Smartz with CallCabinet or Smarsh compliance recording on the same contract. What each layer does: - Smartz: voice recording with instant retrieval, the Smartz Desktop Recorder for agent screens, and QA evaluations with a dispute trail in Engage. - Smartz Analyz: audit reports that log every export and recording playback. - FirstNet Compliance Recording: tamper-proof storage with AES-256 rotating encryption, MFA, retention policies, legal hold, defensible deletion and audit logs. - Conversation Analytics tier: transcription, sentiment and automated PCI, PII and PHI redaction for audio and transcripts. This split keeps quality and coaching in the contact-centre platform, and puts the archive that audits and disputes rely on in a purpose-built recording platform. FirstNet Compliance Recording supports programmes for POPIA, FAIS, FICA, PCI-DSS and other frameworks, but final compliance depends on your own policies and configuration. POPIA also expects a consent prompt on recorded lines, which can be built into your IVR welcome announcements. FirstNet can scope Smartz, the voice service and compliance recording together, so they arrive as one design. URL: https://www.firstnet.co.za/knowledge/voice/does-smartz-cover-regulated-call-recording/. Reviewed 2026-10-10. #### Does the FirstNet Smartz contact centre replace our phone system? No. Smartz is the contact-centre layer that sits on top of your voice service, not the dial tone. FirstNet supplies the voice underneath on the same contract, whether that is Yeastar cloud PBX, FirstNet SIP trunks or Microsoft Teams calling, and Smartz can also sit over a third-party PBX via SIP. How Smartz fits each voice set-up: - Yeastar cloud PBX: the full Smartz overlay on a FirstNet-managed PBX. - FirstNet SIP trunks only: Smartz becomes your call platform, with IVR, ACD queues, dialler, agent desktop and wallboards. - Microsoft Teams calling: Teams stays the dial tone, and Smartz adds routing, dialler, messaging, QA and wallboards. - Your existing PBX: Smartz sits over the top via SIP without replacing it, once interoperability has been tested. - New contact centre: Smartz, FirstNet voice, call analytics and caller ID on one contract. Telephony is not part of the Smartz licence itself. It is a separate service on the same FirstNet contract, so you still get one bill and one escalation path. During onboarding, your phone numbers, SIP trunks and caller ID presentation are aligned to the Smartz tenant. FirstNet's Voice Solutions Engineering team wires the two together and checks your network and endpoints before go-live. URL: https://www.firstnet.co.za/knowledge/voice/does-the-smartz-contact-centre-replace-our-phone-system/. Reviewed 2026-10-10. #### How are FirstNet AI Receptionist and AI Transcription minutes billed? FirstNet bills AI Receptionist and AI Transcription minutes on one of two models: On Demand, a once-off bucket of minutes used until it runs out, or Monthly Rolling, a monthly minute quota on a 12-month contract. Each add-on can use a different model. How the two models compare: - On Demand is a once-off purchase that sits on top of your Managed Cloud PBX contract. Minutes do not expire monthly; you use them until depleted, then top up. - Monthly Rolling is a recurring monthly quota on a 12-month contract. The quota refreshes each month and unused minutes do not roll over. - On Demand suits seasonal, campaign or after-hours-only use, as well as pilots and proofs of value. - Monthly Rolling suits steady, always-on use, such as an AI Receptionist on your main inbound line or an ongoing coaching programme using AI Transcription. For example, you could run AI Receptionist on Monthly Rolling for the main line and AI Transcription on On Demand while you trial it. The model is chosen with you at proposal stage, and FirstNet's voice engineers size the minute commitment from your expected call volumes. Quarterly service reviews then track AI minute consumption so the plan can be adjusted as usage grows. URL: https://www.firstnet.co.za/knowledge/voice/how-are-ai-receptionist-and-ai-transcription-minutes-billed/. Reviewed 2026-10-10. #### How are FirstNet Apex BI Clarity wallboards licensed? Clarity wallboards are licensed per concurrent viewer, so it helps to confirm up front how many screens or supervisors need live views at the same time. How Clarity licensing is structured: - Wallboards: per concurrent viewer. - Clarity for PBX: per extension. - Clarity for MS Teams: per user. - Contract terms: 12, 24 or 36 months. When sizing, count every screen on the contact-centre floor and every supervisor or manager who needs a live view at the same time. The wallboard viewer count is agreed in the planning phase, together with the cost-centre model and chargeback rules, and the wallboards are staged during the pilot. The wallboards themselves give contact-centre and customer-facing teams a real-time view of calls in the queue, the longest wait, agents available and calls in progress. They sit alongside Clarity's historical reporting on call duration, abandonment, agent performance and queue statistics. Accurate extension, user and viewer counts matter for large estates, because they drive the quote. FirstNet's voice specialists confirm them with you before pricing. URL: https://www.firstnet.co.za/knowledge/voice/how-are-wallboards-licensed/. Reviewed 2026-10-10. #### How are calls on FirstNet SIP trunks billed? Calls on FirstNet SIP Trunks are billed on a voice plan, either Voice Bundles with a fixed number of inclusive minutes or Voice Rate Options with per-minute rates. Billing is per second, so you pay for the time used rather than rounded-up minutes. How the commercial model is structured: - Channels: licensed per concurrent call as a monthly operating cost, not a capital purchase. - Voice Bundles: a fixed number of inclusive minutes. - Voice Rate Options: per-minute rates, with a custom rate sheet available on request. - Contract term: 12, 24 or 36 months. - Once-off items such as installation and number porting are quoted separately. - Backup trunk: free with FirstNet connectivity, otherwise a separate line item. Per-second billing makes the biggest difference for businesses that make many short calls. Pricing depends on traffic volume, destination mix and routing requirements, so FirstNet quotes from your call profile rather than a generic price list. Usage, rate classes and call patterns can be tracked on a dashboard, and fraud monitoring with destination blocking helps prevent unexpected spend. FirstNet's voice team can supply a rate sheet for the destinations you call most. URL: https://www.firstnet.co.za/knowledge/voice/how-are-sip-trunk-calls-billed/. Reviewed 2026-10-10. #### How do I buy business voice minutes from FirstNet? You choose a plan that fits your calling pattern, such as pay-as-you-go minutes, a monthly bundle or a committed volume, and FirstNet activates it on your PBX, VoIP platform or SIP trunk so you can start calling straight away. Getting started takes three steps: connect your PBX, VoIP platform or SIP trunk to FirstNet, activate your preferred minute plan, then start calling with real-time monitoring and usage controls in place. The plan options: - Pay-as-you-go minutes, suited to SMBs that want a low commitment. - Committed monthly bundles, suited to enterprises and resellers with steady volumes. - Voice Bundles on FirstNet SIP Trunks, with a fixed number of inclusive minutes. - Voice Rate Options, with per-minute rates and a custom rate sheet on request. - Specialised international routes for calls to global destinations. All calls are billed per second. On SIP trunks, channels are a monthly operating cost on 12, 24 or 36-month terms. Because pricing depends on traffic volume, destination mix and routing requirements, FirstNet prepares a customised rate card based on your call profile. If you are moving from another carrier, a FirstNet Voice Readiness Assessment can map out the migration phases and timelines. URL: https://www.firstnet.co.za/knowledge/voice/how-do-i-buy-voice-minutes/. Reviewed 2026-10-10. #### How does FirstNet Compliance Recording protect call recordings? Recordings are kept in tamper-proof storage with rotating 256-bit AES encryption at rest and in transit. Admin and reviewer access requires multi-factor authentication, permissions can be limited by user, group, recording type and metadata, and every access is logged. The layers of protection: - Encryption: AES-256 with periodic key rotation, for stored recordings and recordings in transit. - Tamper-proof storage: recordings cannot be altered or deleted outside policy, backed by immutable retention controls. - Access control: MFA on admin and reviewer roles, plus granular role-based permissions. - Audit logs: a chain-of-custody record of who accessed which recording, when and what they did. - Controlled sharing: sharing outside the platform, for example with regulators or legal counsel, is controlled and logged. - Defensible deletion: recordings are disposed of at the end of retention in a logged, policy-driven way. Access can be tied to your existing identity provider through single sign-on, validated during design. For card and health data, the Conversation Analytics tier adds automated redaction from audio and transcripts. FirstNet provisions encryption, MFA, roles and retention policies during onboarding, and owns escalation of any underlying platform incident through to closure. URL: https://www.firstnet.co.za/knowledge/voice/how-are-call-recordings-protected/. Reviewed 2026-10-10. #### How does FirstNet protect Zoom Phone against toll fraud? FirstNet monitors voice traffic for fraud around the clock. Its 24/7 network operations centre (NOC) uses real-time call records and traffic anomaly detection, and premium-rate and exotic destinations, such as satellite networks, are blocked by default. The layers of protection: - Real-time call detail records, so unusual activity is visible as it happens. - Traffic anomaly detection on calls passing through FirstNet's network. - Premium-rate and exotic destinations blocked by default. - International calling sold as destination-specific bundles, rather than open access to every destination. Toll fraud usually involves criminals pushing calls to expensive international or premium-rate numbers through a compromised phone system or account, leaving the business with the bill. Blocking risky destinations by default limits that exposure even if an account is compromised. Local support is available in English and Afrikaans during South African business hours, with the NOC handling voice incidents at any time. You also have a part to play: protect Zoom admin and user accounts with strong authentication, and raise any need to call unusual destinations with FirstNet in advance, so it can be reviewed before it is enabled rather than in the middle of a campaign. URL: https://www.firstnet.co.za/knowledge/voice/how-does-firstnet-protect-zoom-phone-against-toll-fraud/. Reviewed 2026-10-10. #### How does Truecaller verified caller ID stop people impersonating my business? Once your brand profile is verified through FirstNet, it is locked. Community edits and impersonators cannot change the name, logo or category shown on the call screen, and only authorised changes made through FirstNet are accepted. How brand protection works: - Verification: FirstNet checks proof of number ownership and business registration before the profile goes live. - Green badge: calls from your verified numbers carry the badge, which spoofed or community-suggested entries do not. - Locked identity: community edits cannot alter the profile. - Controlled changes: new numbers, branding updates and call-reason changes go through FirstNet's change control. This makes it harder for fraudsters to pass themselves off as your brand, because genuine calls carry a verified name and badge that fake ones lack. It is especially relevant for teams making fraud verification, payment or collections calls. Verification protects the calls you make from your authorised numbers. It cannot stop criminals calling your customers from other numbers, so pair it with clear customer communication, such as telling customers to look for your verified badge on genuine calls. Verified Message ID extends the same verified identity to SMS, including one-time PINs and payment alerts. URL: https://www.firstnet.co.za/knowledge/voice/how-does-verified-caller-id-stop-people-impersonating-my-business/. Reviewed 2026-10-10. #### How is the FirstNet AI Receptionist trained on my business? You train FirstNet AI Receptionist on your own content: PDFs, documents, website URLs and FAQs. Setup follows a four-step wizard, and FirstNet's voice engineers work through it with you before the service goes live. The four steps: - Create: set up an AI Receptionist extension on your Managed Cloud PBX. - Customise: choose the voice, tone, persona and languages callers will hear. - Train: load your knowledge base of documents, website pages and FAQs. - Test and publish: run sample calls, confirm escalation rules, then go live. To prepare, list the top reasons people call you, decide which intents should always go to a person, and write five to ten test scenarios. FirstNet works from a knowledge-base checklist covering your documents, intent list, escalation rules and voice selection, and designs the routing for IVR, queues, after-hours and overflow at the same time. Before sign-off, user acceptance testing confirms that the AI Receptionist is live and escalating correctly. After go-live, quarterly service reviews cover AI minute usage and any planned re-training of the knowledge base, so answers stay current as your business changes. URL: https://www.firstnet.co.za/knowledge/voice/how-is-the-ai-receptionist-trained-on-my-business/. Reviewed 2026-10-10. #### How long before FirstNet Apex BI Clarity telecom reports are useful? Dashboards and chargeback rules are typically tuned to your cost-centre model within 2 to 4 weeks after data starts flowing. Data begins arriving once the PBX feed or Teams Graph API connection is live, and the tuning period makes the reports accurate for your business. The typical sequence: - Prepare: your cost-centre model is agreed and your Global Admin is briefed on Graph API consent. - Plan: modules are confirmed (PBX, Teams or both), along with the wallboard viewer count and chargeback rules. - Provision: the Apex BI tenant is created, feeds are connected and data flow is validated. - Pilot: initial dashboards are built and chargeback rules calibrated with a pilot team over 2 to 4 weeks, while wallboards are staged. - Production: full rollout, plus training for supervisors and finance. Because wallboards are staged during the pilot, supervisors can start using live queue views before full rollout. The first month's report is also where customers usually see recoverable spend, such as mis-billed extensions or under-used services, quantified for their own estate. Legacy PBX integrations that need an adapter may add lead time before data starts flowing, so FirstNet scopes those early in planning. URL: https://www.firstnet.co.za/knowledge/voice/how-long-before-reports-are-useful/. Reviewed 2026-10-10. #### How long does FirstNet Compliance Recording store call recordings? As long as your policy requires. Retention in FirstNet Compliance Recording is configurable per policy and can vary by call type or business unit, so each set of recordings is kept for the period your regulator, contracts or internal rules set. How retention works: - You confirm your retention policy in writing before onboarding, and FirstNet configures it during provisioning. - Different rules can apply to different call types or business units, such as advice lines and general service lines. - At the end of the retention period, recordings are disposed of through logged, defensible deletion. - Legal hold preserves specific recordings beyond normal retention for litigation, disputes or regulatory inquiries. - Storage is sized to the agreed retention period and your platform mix. As a guide, FSCA and FAIS-regulated firms commonly keep advice-call recordings for five years, but the right period depends on your obligations. Edits to retention after go-live go through FirstNet's change control, so changes are deliberate and recorded. Throughout the retention period, recordings stay in tamper-proof storage with AES-256 encryption, and audit logs show who accessed what and when. Historical recordings from an older recorder can be migrated in with chain of custody preserved, so one retention policy covers old and new calls. URL: https://www.firstnet.co.za/knowledge/voice/how-long-are-recordings-stored/. Reviewed 2026-10-10. #### How long does a Zoom Contact Centre implementation take with FirstNet? Typically 6 to 12 weeks end to end. Smaller voice-only Essential deployments can take 4 to 6 weeks, while omnichannel Elite deployments with several CRM integrations and complex IVR run 12 to 16 weeks. What drives the timeline: - Agent count and number of sites. - Channel mix: voice only, or voice plus webchat, SMS, social and email. - IVR complexity: languages, skills-based routing, after-hours, overflow and call-back. - CRM integrations: HubSpot, Salesforce and ServiceNow have native connectors, while custom CTI takes longer. - Number porting, which depends on the losing carrier and typically takes 5 to 15 business days. The work runs in phases: discovery, design and quote, provisioning on your Zoom tenant, a pilot and parallel run with your current platform, then cutover with 30 days of hyper-care. FirstNet confirms a realistic timeline once your scope is designed, and does not promise dates that depend on customer-side dependencies or other carriers. To stay on schedule, have your CRM owner, Zoom admin and a signed Letter of Authority for your numbers ready early, and agree the pilot agent group and cutover window up front. URL: https://www.firstnet.co.za/knowledge/voice/how-long-does-a-zoom-contact-centre-implementation-take/. Reviewed 2026-10-10. #### How long does number porting take when moving to Microsoft Teams calling with FirstNet? A typical port takes 5 to 15 business days from the losing carrier. FirstNet captures the porting scope and a signed Letter of Authority (LoA) up front, and stages the cutover with a rollback plan so calls keep flowing. What affects the timeline: - How quickly your current (losing) carrier responds. - The size of the range: large blocks, multi-site or multi-carrier consolidations usually take 3 to 6 weeks. - Whether numbers are tied to other services, such as copper, ADSL or bundled lines. - Whether the account holder details on the LoA exactly match your current carrier account. In Teams, ported numbers are assigned and managed in the Teams Admin Center with Operator Connect, or through voice routing with Direct Routing. Porting starts in the Provision phase, and the number cutover happens in the Production phase after pilot users have been tested on Teams. FirstNet does not promise dates that depend on another operator's responsiveness, but it flags porting risks early, agrees a low-traffic cutover window and monitors calls for the first 24 hours after cutover. URL: https://www.firstnet.co.za/knowledge/voice/how-long-does-number-porting-take/. Reviewed 2026-10-10. #### How many SIP trunk channels does my business need from FirstNet? You need one channel for each call you expect to run at the same time at your busiest point, not one per employee. FirstNet sizes SIP trunk channels from your real call traffic, so you avoid both blocked calls and paying for capacity you never use. What goes into the sizing: - Peak concurrent calls, inbound and outbound, at the busiest time of day. - The number of direct numbers (DIDs) in active use, and which ones need porting. - Your calling profile across local, mobile, international and premium-rate destinations. - The size of the backup trunk, where you have one. A business with 50 staff may need only a fraction of that in simultaneous calls. Too few channels means callers hear a busy signal and outbound calls are blocked; too many wastes spend, because channel licensing is a monthly operating cost. Bandwidth follows the channel count. FirstNet plans for about 100 Kbps per concurrent call plus 20% headroom on the internet link, so 10 channels need roughly 1.2 Mbps reserved for voice. FirstNet's voice engineers confirm the channel count during solution design, and the platform scales from five users to five thousand without architectural changes. URL: https://www.firstnet.co.za/knowledge/voice/how-many-sip-channels-do-i-need/. Reviewed 2026-10-10. #### How many languages does the FirstNet AI Receptionist speak? FirstNet AI Receptionist supports 34 languages. You can also customise the AI voice, including gender, tone and persona, so it sounds consistent with your brand. How language set-up works: - The languages your callers actually use are confirmed during scoping, together with the voice and persona. - The AI Receptionist is trained on your own content, such as PDFs, documents, website pages and FAQs, so answers reflect your business. - Routing rules direct callers by intent to the right menu, queue or extension. - Complex or sensitive intents are escalated to a human agent in the Linkus app, with the transcript and AI summary attached. Multilingual answering suits businesses with diverse customers, such as logistics and distribution companies, retailers and franchises, healthcare practices and public-sector lines serving citizens. It is especially useful after hours and during overflow, when the AI Receptionist may be the first voice a caller hears. FirstNet AI Transcription, the companion add-on for turning calls into text, also supports multiple languages. Its active language list follows the current platform release and is confirmed by FirstNet's voice engineers during scoping, so check both lists against your callers' languages before you commit. URL: https://www.firstnet.co.za/knowledge/voice/how-many-languages-does-the-firstnet-ai-receptionist-speak/. Reviewed 2026-10-10. #### How much IT effort does FirstNet Apex BI Clarity need to set up? Very little on a FirstNet voice platform. On FirstNet Hosted PBX the call data feed is native, so there is nothing for your team to connect. For Microsoft Teams, your Global Admin grants Microsoft Graph API permissions once during onboarding. What your team is asked to do: - Agree the cost-centre model and how many people need live wallboard views. - For Teams: have a Microsoft 365 Global Admin grant the one-time Graph API consent. - For a legacy PBX: confirm CDR or SMDR feed access, so FirstNet can scope any adapter. - Review the pilot dashboards and chargeback rules with a pilot team. - Make supervisors and finance staff available for training before full rollout. FirstNet handles the rest across five phases: prepare, plan, provision (tenant created, feeds connected and data flow validated), pilot (dashboards built and tuned over 2 to 4 weeks) and production. FirstNet provides project management, technical delivery and customer success support throughout. Because Clarity is a productised cloud platform with Apex BI's roadmap behind it, changes such as Microsoft Graph API updates are handled in the product rather than by your team. Support, including escalation to Apex BI, runs through FirstNet as your single point of contact. URL: https://www.firstnet.co.za/knowledge/voice/how-much-effort-is-needed-from-our-it-team/. Reviewed 2026-10-10. #### How much will FirstNet Truecaller for Business improve our call answer rate? Results vary by customer base, so FirstNet does not promise a fixed uplift. Instead, a pilot on one or two priority numbers measures the change in answer rate against your own baseline before you roll out more widely. How the improvement is measured: - Baseline: answer rates on your priority numbers are captured at the start of the pilot. - Pilot: the verified identity, green badge and call reasons go live on those numbers. - Analytics: the dashboard tracks contact or pickup rate, time-slot patterns, spam-report trends and segmented call patterns. - Review: a post-implementation review is held 30 to 90 days after rollout. Results are shaped by how many of your customers use Truecaller, how clear and relevant your call reasons are, and when you call. The time-slot analysis shows when customers are most likely to pick up, so call timing can be adjusted. Other measures worth tracking are fewer retries per contact, fewer spam reports and better conversion on outbound campaigns. For customers who still miss your call, Call Me Back lets them choose a callback slot, which can recover contacts that would otherwise need another attempt. URL: https://www.firstnet.co.za/knowledge/voice/how-much-will-our-answer-rate-improve/. Reviewed 2026-10-10. #### How quickly can contact-centre agents get productive on FirstNet Smartz? Smartz Academy gives each role a learning path with certificates. For example, the Commz Agent path takes about 5 hours, Engage User about 1 hour 15 minutes and Analyz about 1 hour 40 minutes, and managers can see enrolment and completion, so adoption is measurable. Learning paths by role (approximate): - Introduction: about 10 minutes. - Engage User: about 1 hour 15 minutes. - Analyz: about 1 hour 40 minutes. - Engage Supervisor: about 3 hours 5 minutes. - Commz Agent: about 5 hours 10 minutes. - Commz Supervisor: about 13 hours 20 minutes. An Engage Administrator path of about 2 hours is also available. Each path uses numbered curricula with micro-lessons, multimedia, quizzes, exams and certificates of completion. Manager Insights shows unique users, total enrolments, how many learners have started versus completed, and who has not signed in, so licences do not go unused. At go-live, FirstNet enrols your agents and supervisors in the relevant Smartz Academy courses before handing over to FirstNet Support. Engage also includes e-learning for your own material, so product and process training can sit alongside the Smartz courses in one place. URL: https://www.firstnet.co.za/knowledge/voice/how-quickly-can-contact-centre-agents-get-productive-on-smartz/. Reviewed 2026-10-10. #### Is FirstNet AI Transcription enough for FSCA or POPIA call recording? No. FirstNet AI Transcription is a productivity tool for coaching, quality review and follow-up. Regulated, audit-grade recording with retention policies and legal hold is provided by FirstNet Compliance Recording. How the two differ: - AI Transcription gives live and post-call transcripts, AI summaries of topics, decisions and action items, speaker identification and searchable call logs in the PBX portal. - Compliance Recording gives tamper-proof storage with AES-256 encryption, MFA, granular permissions, retention policies, legal hold, audit logs and controlled sharing. - Compliance Recording supports compliance programmes for POPIA, FAIS, FICA, PCI-DSS and other frameworks, across Teams, Zoom, PBX and contact-centre calls. Many regulated businesses use both: AI Transcription for day-to-day productivity, and Compliance Recording for the archive that audits and disputes rely on. FirstNet does not promise 100% transcription accuracy, which is another reason transcripts are positioned as a working aid rather than the record of the call. Retention matters too. FSCA and FAIS-regulated firms commonly keep advice-call recordings for five years, and POPIA requires a consent prompt on recorded lines, which FirstNet Compliance Recording configures and tests during activation. Final compliance still depends on your own policies and configuration. URL: https://www.firstnet.co.za/knowledge/voice/is-ai-transcription-enough-for-fsca-or-popia-recording/. Reviewed 2026-10-10. #### Is FirstNet Truecaller for Business POPIA compliant? Compliance is shared. FirstNet delivers the service under ISO 27001 and ISO 9001, and number ownership is verified at onboarding, but your call-reason content and consent practices also shape POPIA outcomes, so FirstNet does not claim compliance on your behalf. What FirstNet is responsible for: - Delivering the service under an ISO 27001 information security management system, covering security governance, risk management, change control, monitoring and incident response. - Following ISO 9001 quality processes for service delivery. - Verifying proof of number ownership and business registration before your brand profile goes live. - Locking your verified identity so that only authorised changes made through FirstNet are accepted. What stays with you is the content of your call reasons, your consent practices for contacting customers, and your internal legal and brand approvals. In practice, keep call reasons general enough that they do not disclose personal information on a recipient's screen, check that your outbound calling has a lawful basis, and have your compliance team approve the profile and call reasons before the pilot. FirstNet is also ICASA-licensed for ECS and ECNS, and verification of number ownership helps keep your brand from being attached to numbers you do not control. URL: https://www.firstnet.co.za/knowledge/voice/is-it-popia-compliant/. Reviewed 2026-10-10. #### Is FirstNet an ICASA-licensed voice operator in South Africa? Yes. FirstNet holds ICASA ECNS and ECS licences, so it is a licensed South African voice operator that can hold and terminate South African geographic numbers directly, rather than reselling another operator's licence. What the licence means in practice: - Every voice service FirstNet sells, from Managed Cloud PBX and SIP trunks to Microsoft Teams calling and Zoom Phone, runs on FirstNet's own ICASA-licensed voice network. - Calls reach Telkom, Vodacom, MTN, Cell C and other licensees through FirstNet's interconnect agreements. - New numbers can be issued from FirstNet's own number allocations, and existing numbers can be ported in or out. - Porting follows South Africa's number portability regulations and runs on a Letter of Authority you sign. - Trunks, voice plans and porting are supported by a 24x7 South African-based team. Why it matters: only ECNS and ECS licensees can hold and terminate South African geographic numbers, so a provider without these licences is reselling under someone else's. For regulated buyers and public-sector procurement, FirstNet can provide confirmation of its ECNS and ECS licences on request. URL: https://www.firstnet.co.za/knowledge/voice/is-firstnet-a-licensed-voice-operator/. Reviewed 2026-10-10. #### Is Microsoft Purview enough for Teams call recording compliance? Usually not on its own. Microsoft Purview Communication Compliance focuses on policy and supervision inside Microsoft 365, and it does not capture compliant audio across PBX, Zoom or other non-Teams platforms. FirstNet Compliance Recording records the whole voice estate into one archive. What FirstNet Compliance Recording provides: - Compliant audio capture of Teams voice and meetings tied to each user's identity, plus Zoom, PBX, SIP and contact-centre calls. - Tamper-proof storage with AES-256 rotating encryption. - Retention policies, legal hold and defensible deletion for recordings. - Audit logs and controlled sharing with auditors, regulators or legal counsel. - Optional QA workflows, transcription, sentiment and automated PCI, PII and PHI redaction. The two do different jobs. Purview supervises communications policy inside Microsoft 365, while a compliance recording platform captures and governs the audio itself. For organisations moving to Teams calling with FirstNet Operator Connect or Direct Routing, compliance recording is available as an add-on through CallCabinet, powered by Smarsh. One archive, one policy and one search then apply whether a call happened on Teams, Zoom or the PBX. URL: https://www.firstnet.co.za/knowledge/voice/is-microsoft-purview-enough-for-call-recording-compliance/. Reviewed 2026-10-10. #### Is Yeastar P-Series a cloud PBX, and how does FirstNet use it? Yes. Yeastar P-Series is a cloud PBX platform with unified communications features, mobile apps and call centre capabilities. FirstNet uses it as the platform underneath FirstNet Managed Cloud PBX, which FirstNet sells, deploys, supports and bills as one managed service. What the platform provides through FirstNet: - Voice, video, chat and presence in one unified communications system. - Linkus softphone and mobile apps for hybrid and remote teams. - Call queues, IVR, recording, reporting and monitoring. - Optional FirstNet AI Receptionist and AI Transcription add-ons. - Hosting in South Africa for low latency, with local termination on FirstNet's network. The difference with FirstNet is the managed layer on top. FirstNet handles design, number porting, deployment and day-to-day operations, with one contract, one bill and a South African support team as the single escalation path. Migration paths cover on-premises PBXs, 3CX, Mitel and similar systems, using either a side-by-side cutover in waves or a single weekend cutover for smaller sites. Businesses that already own a Yeastar or another SIP-compliant PBX can instead connect it to FirstNet SIP Trunks. URL: https://www.firstnet.co.za/knowledge/voice/is-yeastar-p-series-a-cloud-pbx/. Reviewed 2026-10-10. #### Is call recording included in FirstNet Managed Cloud PBX? Yes. Call recording is part of the core FirstNet Managed Cloud PBX service, together with IVR, call queues, standard reporting and the Linkus mobile and desktop softphones. What the core service includes: - Extensions, call routing, voicemail, hold music and presence. - IVR menus, call queues, call recording and standard reporting. - Linkus mobile and desktop softphone apps, using the same number everywhere. - SIP trunking and number porting with local South African termination. - Standard support and platform operations as part of the per-user service. Optional add-ons include AI Receptionist, AI Transcription, Microsoft Teams calling integration, CRM integrations and contact-centre wallboards. The built-in recording suits everyday call review. If you need regulated, audit-grade recording, for example for FSCA, FAIS or POPIA obligations, add FirstNet Compliance Recording, which provides tamper-proof storage, retention policies, legal hold and audit logs. Whichever you use, POPIA expects callers to be told that calls are recorded, so plan a consent prompt on recorded lines and decide before go-live whether to record all calls, only some, or none. URL: https://www.firstnet.co.za/knowledge/voice/is-the-call-recording-included/. Reviewed 2026-10-10. #### Isn't Microsoft Teams or Zoom native call recording enough for compliance? Usually not for regulated recording. Native recording in Teams or Zoom stores calls, but it lacks the tamper-proof storage, granular retention, legal hold, audit logs and cross-platform consistency that audits and disputes rely on. What FirstNet Compliance Recording adds: - Tamper-proof storage, with AES-256 rotating encryption at rest and in transit. - Retention policies by call type or business unit, ending in logged, defensible deletion. - Legal hold to preserve specific recordings for litigation, disputes or regulatory inquiries. - Audit logs showing who accessed which recording, when and what they did. - One archive, one policy and one search across Teams, Zoom, PBX and contact-centre calls. For Microsoft Teams, recording covers voice and meetings and attaches to each user's identity. For Zoom, it covers Zoom Meetings, Zoom Phone and Zoom Contact Center; Zoom Phone users who need compliance recording require the Zoom Phone Power Pack licence. Native recording can still be handy for informal meeting playback. The real test is whether a recording would stand up when a regulator, auditor or court asks for it, and whether every platform in your business follows the same rules. FirstNet Compliance Recording is delivered on the CallCabinet and Smarsh platforms, with FirstNet handling onboarding and support. URL: https://www.firstnet.co.za/knowledge/voice/isnt-teams-or-zoom-native-recording-enough/. Reviewed 2026-10-10. #### Should we replace our copper PRI or ISDN lines with FirstNet SIP trunks? For most businesses, yes. Copper PRI and BRI (ISDN) lines run on infrastructure that is end-of-life across South Africa, and spares, replacement timelines and support are getting harder to secure. FirstNet SIP Trunks give you more channels, better quality and a backup option that a copper line cannot match. How a copper-to-SIP move works: - If your PBX is SIP-compliant, it connects to the trunk directly. - If it only has digital (TDM) interfaces, a media gateway converts PRI, BRI or analogue lines to SIP. - Part of the old estate can run alongside during migration, using a hybrid-coexistence design. - Your existing numbers are ported to FirstNet using a signed Letter of Authority. - Numbers bundled with copper or ADSL services may need that service terminated or migrated first. FirstNet follows a five-phase journey (prepare, plan, provision, pilot and production), with test calls and backup failover tests before the final cutover. If your PBX is also nearing end of life, you can move to FirstNet Managed Cloud PBX on the same trunk, either now or later. FirstNet connectivity customers also get a free backup SIP trunk with automatic failover. URL: https://www.firstnet.co.za/knowledge/voice/should-we-replace-our-copper-pri-or-isdn-lines-with-sip-trunks/. Reviewed 2026-10-10. #### What Microsoft licences do we need for Teams calling with FirstNet? Each user who needs a phone number requires a Microsoft Teams Phone Standard or E5 licence, and your Microsoft 365 tenant must be in Teams-Only mode. If you are not licensed yet, FirstNet can supply Teams Phone licences as a Microsoft CSP. What to check before you start: - Teams Phone Standard, or E5 which includes Teams Phone, for every user who will make or receive external calls. - Teams-Only mode in the tenant. - Audio Conferencing licences where users need them for meetings. - A Global Admin available for the integration window. - A FirstNet voice plan: Voice Bundles with inclusive minutes, or Voice Rate Options with per-minute rates. You do not need Microsoft Calling Plans to use FirstNet. Operator Connect or Direct Routing provides the phone numbers and calling instead, and both can still coexist with Calling Plans in the same tenant if some users stay on them. In the Prepare phase, FirstNet reviews your licensing inventory, tenant readiness, federation and existing voice routing, then gives you a readiness checklist of anything to fix before go-live. Where licences are needed, FirstNet can supply them alongside the calling service, so licences and voice sit on one contract. URL: https://www.firstnet.co.za/knowledge/voice/what-licences-do-we-need/. Reviewed 2026-10-10. #### What affects the price of business voice minutes from FirstNet? Voice minute pricing depends mainly on your call volume, the destinations you call, your routing requirements and your usage pattern. FirstNet prices each customer from their call profile, so the best way to get an accurate figure is to request a customised rate card. The main factors: - Volume: higher and committed volumes qualify for tiered pricing. - Destination mix: local geographic, mobile, international and premium-rate destinations are rated differently. - Routing requirements: specialised international routes and quality-focused routing affect the rate. - Plan type: Voice Bundles with inclusive minutes, or Voice Rate Options with per-minute rates. - Contract term: SIP trunk channels run on 12, 24 or 36-month terms. Billing is per second, so you pay for the time actually used rather than rounded-up minutes. This matters most for businesses that make many short calls. Capacity also affects total cost. On FirstNet SIP Trunks, channels are sized to your peak concurrent calls rather than headcount, using your real call traffic, so you are not paying for capacity you never use. Fraud controls such as destination blocking and spending controls help keep unexpected international or premium-rate charges off your bill. URL: https://www.firstnet.co.za/knowledge/voice/what-affects-voice-minute-pricing/. Reviewed 2026-10-10. #### What are FirstNet business voice minutes and what are they used for? Business voice minutes are the call time your business uses to call the public phone network from a VoIP platform, SIP trunk or PBX. FirstNet sells them prepaid or postpaid. The PBX, cloud phone system or SIP trunk is the platform your calls start from; the minutes are the calling itself. FirstNet carries the calls over its own ICASA-licensed voice network. Calls route to Telkom, Vodacom, MTN, Cell C and other licensees through direct interconnects, with multiple upstream interconnects for resilience and best-path routing. Where the minutes are used: - SIP trunks connected to an on-premises or cloud-hosted PBX. - Hosted PBX and cloud phone systems, including FirstNet Managed Cloud PBX. - Contact centres and BPOs handling large inbound and outbound volumes. - Resellers and IT service providers building their own VoIP, PBX or UCaaS offering. - International calling, with destination-specific routing and pricing. How you can buy them: - Pay-as-you-go minutes with no long-term commitment, suited to SMBs. - Tiered volume discounts for growing businesses. - Committed monthly bundles, suited to enterprises and resellers with steady volumes. - Specialised international routes for global call termination. On FirstNet SIP Trunks, minutes come on a voice plan: Voice Bundles with a fixed number of inclusive minutes, or Voice Rate Options with per-minute rates and a custom rate sheet on request. Billing is per second, so you pay for the time actually used rather than rounded-up minutes. That matters most for businesses that make many short calls. Pricing depends on traffic volume, destination mix and routing requirements. Local geographic, mobile, international and premium-rate destinations are rated differently, so FirstNet prepares a customised rate card from your call profile rather than quoting a generic price list. Minutes are separate from capacity. On SIP trunks, channels are sized to your peak concurrent calls rather than headcount and are a monthly operating cost on 12, 24 or 36-month terms, so your total voice cost is the channels plus the calls on your plan. Getting started takes three steps: connect your PBX, VoIP platform or SIP trunk to FirstNet, activate your plan, then start calling with real-time monitoring and usage controls in place. A dashboard tracks consumption, rate classes, call patterns and cost forecasts, and the platform supports five users or five thousand without architectural changes. Fraud controls, including anomaly detection, destination blocking and spending controls, help protect you against unexpected call charges. Resellers and service providers can buy bulk minutes with white-label or API-based integration through the FirstNet reseller programme. URL: https://www.firstnet.co.za/knowledge/voice/what-are-business-voice-minutes/. Reviewed 2026-10-11. #### What are VC minutes and on-net minutes? On-net minutes are calls that stay on one provider's network. VC minutes has no single industry meaning, so check your provider's definition. FirstNet bills calls per second, by destination type. On-net and off-net: in general, an on-net call starts and ends on the same operator's network, while an off-net call crosses to another operator, such as a call from a business line to a mobile network. Many providers price on-net calls lower because no other network is involved. Calls between extensions on the same phone system usually stay inside the PBX and never reach the public network. VC minutes: the term appears on some price lists and contracts, but providers do not use it consistently. If a quote or bill lists VC minutes, ask the provider to state in writing which calls count against them and how they are rated. How FirstNet bills calls: - Calls run on a voice plan: Voice Bundles with a fixed number of inclusive minutes, or Voice Rate Options with per-minute rates. - Billing is per second, so short calls are not rounded up to full minutes. - Local geographic, mobile, international and premium-rate destinations are rated differently. - Calls reach Telkom, Vodacom, MTN, Cell C and other licensees through FirstNet's direct interconnects. Because pricing depends on traffic volume, destination mix and routing requirements, FirstNet prepares a customised rate card from your call profile. Comparing rate cards destination by destination is a fairer test than comparing headline minute counts between providers. URL: https://www.firstnet.co.za/knowledge/voice/what-are-vc-minutes-and-on-net-minutes/. Reviewed 2026-10-11. #### What causes number porting delays when moving numbers to FirstNet? Most porting rejections come from mismatched account holder details, or from numbers still tied to copper lines, ADSL or bundled services with the losing carrier. Accurate entity details and a promptly signed Letter of Authority (LoA) avoid most delays. Common causes and how to avoid them: - Account holder mismatch: give the exact entity name and registration, billing address and account number your current carrier holds. Mismatches cause most rejections. - Numbers tied to other services: if a number sits on a copper line, ADSL or bundled fibre voice, that service must be terminated or migrated first. - Stale paperwork: an LoA that is signed late or submitted too long after signing is a common reason for rejection. - Missed porting windows: ports happen in fixed windows, and missing a slot can push go-live out by 5 to 10 working days. A typical port takes 5 to 15 business days from LoA submission. Large blocks, multi-site or multi-carrier consolidations usually take 3 to 6 weeks. FirstNet prepares the LoA, submits it to the losing carrier and handles any queries. It does not control the other carrier's response time, so it does not promise dates that depend on another operator, but it flags these risks early in planning. URL: https://www.firstnet.co.za/knowledge/voice/what-causes-porting-delays/. Reviewed 2026-10-10. #### What do FirstNet Apex BI Clarity live call-centre wallboards show? Clarity wallboards give contact-centre and customer-facing teams a real-time view of their operation, including calls in the queue, the longest wait, agents available and calls in progress. Supervisors can spot pressure points as they happen and respond before service levels slip. What supervisors see: - Queue status: calls waiting and the longest current wait. - Agents available to take calls. - Calls in progress across the team. - Queue statistics and abandonment in the wider Clarity dashboards. Wallboards are available for FirstNet Hosted PBX and, through Clarity for MS Teams, for Teams calling. They are licensed per concurrent viewer, so it helps to know how many screens and people need live access before setup. The viewer count is agreed in planning, and wallboards are staged during the pilot. Wallboards complement Clarity's historical reporting on call duration, abandonment and agent performance, and its chargeback reporting for finance. For a full omnichannel contact centre with its own near-real-time wallboards, workforce management and quality assurance, FirstNet also offers the Smartz Contact Centre, which can sit alongside Clarity on the same contract. URL: https://www.firstnet.co.za/knowledge/voice/what-do-live-call-centre-wallboards-show/. Reviewed 2026-10-10. #### What do I need to prepare before switching to a new business phone system with FirstNet? Have a finalised user list, a signed Letter of Authority for your numbers and an agreed cutover window. FirstNet also checks your network, power and devices before go-live, so calls work from day one. Checklist before cutover: - User list: each person's name, extension, direct number (DDI), device type, voicemail and call-group membership, on FirstNet's user-matrix template. - Letter of Authority: signed, and matching exactly the company name and registration on your current carrier account. - Change window: an agreed slot for the porting cutover, with your team available on the day and the day after. - Devices: desk phones on site for day one, or softphones chosen instead. - Power: UPS cover for the comms cabinet and reception phones, so calls continue during load-shedding. - Network and recording: an uncontended link with QoS, SIP ALG disabled, PoE for desk phones, and a decision on which calls to record. Number ports happen in fixed porting windows, and missing a slot can delay go-live by 5 to 10 working days. Changes to the user list mid-deployment also cause rework, so finalising it early is the simplest way to protect your go-live date. URL: https://www.firstnet.co.za/knowledge/voice/what-do-i-need-to-prepare-before-switching-to-a-new-business-phone-system/. Reviewed 2026-10-10. #### What does FirstNet AI Transcription do on business calls? FirstNet AI Transcription turns calls into text, both live during the call and afterwards, and writes an AI summary of key topics, decisions and action items. It is a productivity add-on for FirstNet Managed Cloud PBX, built for coaching, quality review and follow-up. What it includes: - Real-time transcription during calls. - Post-call transcription of recorded calls and voicemail. - AI summaries of key topics, decisions and action items. - Speaker identification on multi-party calls. - Searchable call logs inside the Managed Cloud PBX portal. Typical uses are sales coaching, support quality reviews and management review, and faster follow-up, since the summary sits with the call record. Language support follows the current platform release and is confirmed during scoping. Two points to plan for. First, it cannot run alongside a third-party speech-to-text engine on the same PBX, so an existing one would need to be retired. Second, it does not replace regulated compliance recording: for FSCA, POPIA or healthcare audit-grade recording with retention and legal hold, pair it with FirstNet Compliance Recording. Lines that are recorded also need a POPIA consent prompt. URL: https://www.firstnet.co.za/knowledge/voice/what-does-ai-call-transcription-do/. Reviewed 2026-10-10. #### What does it take to get our numbers verified for Truecaller for Business with FirstNet? You provide proof that you own the numbers and proof of business registration. FirstNet validates these with Truecaller and sets up your brand profile, including name, logo, category tag, business page and base call reasons, then pilots on one or two priority numbers before rolling out. The onboarding steps: - Scope: confirm the caller IDs in scope, call reasons and key contacts. - Verification: provide proof of number ownership and business registration for FirstNet to validate with Truecaller. - Brand profile: set up the brand name, logo, category tag, business profile page and base call reasons. - Integration: connect your CRM or dialler if dynamic call reasons are needed. - Pilot: go live on one or two priority numbers and capture baseline answer rates. - Rollout: extend to the remaining numbers, with a post-implementation review after 30 to 90 days. Timing depends on the size of your number estate, the integration scope and how quickly your internal brand and compliance approvals move. Large estates, multi-region rollouts and dynamic reasons start with a technical workshop before timelines are committed. After handover, FirstNet's 24x7 Rapid Response service desk supports you and handles changes such as adding numbers or updating call reasons. URL: https://www.firstnet.co.za/knowledge/voice/what-does-it-take-to-get-our-numbers-verified/. Reviewed 2026-10-10. #### What does the FirstNet SLA cover for Microsoft Teams calling? The FirstNet SLA for Microsoft Teams calling covers the parts FirstNet manages: PSTN links, the SBC platform, number provisioning and FirstNet's support response. Microsoft's own services stay with Microsoft, but FirstNet runs the joint escalation with Microsoft for you. What sits where: - Covered by FirstNet: PSTN connectivity and call termination, plus the SBCs (session border controllers) it manages. The FirstNet SIP trunk, number provisioning and support are covered too. - Up to Microsoft: the Teams service itself, the Phone System feature and the uptime of your Microsoft 365 tenant. - Outside the SLA: any third-party carrier or internet link you buy yourself. - Joint escalation: FirstNet's Operator Connect or Direct Routing support channel is your one point of escalation. That includes Microsoft issues. FirstNet's service-specific terms and your order form set out service credits, uptime targets and measurement windows. With Direct Routing, an SBC pair with failover or clusters in different locations add resilience. They do not change the contract SLA. The service schedule governs that. Call quality depends on the internet path between your site and Microsoft 365. So FirstNet recommends pairing Teams calling with managed connectivity, ideally with a backup link. Operator Connect also uses direct peering with Microsoft through Azure Peering Services, not best-effort internet. URL: https://www.firstnet.co.za/knowledge/voice/what-does-the-firstnet-sla-cover/. Reviewed 2026-10-10. #### What features does FirstNet Managed Cloud PBX include? FirstNet Managed Cloud PBX includes extensions, call routing, voicemail, hold music and presence, plus IVR menus, call queues, call recording and standard reporting. Linkus mobile and desktop softphones, SIP trunking with local South African termination, number porting, standard support and platform operations are part of the per-user service. Included in the core service: - Extensions, call routing, voicemail, voicemail-to-email, hold music and presence. - IVR menus, call queues, call recording and standard reporting. - Linkus mobile and desktop apps, using the same number in the office, on the road or at home. - SIP trunking and number porting with local South African termination. - Standard support and platform operations. Optional add-ons are FirstNet AI Receptionist, a 24/7 natural-language receptionist in 34 languages, and FirstNet AI Transcription, which produces live and post-call transcripts with AI summaries. Microsoft Teams calling integration, CRM integrations with systems such as HubSpot and Salesforce, and contact-centre reporting and wallboards are also available. Because FirstNet designs, deploys, ports and runs the service, you get one contract, one bill and one escalation path across the PBX, trunks, numbers, softphones and AI add-ons, with billing aligned to the users actually licensed each month. URL: https://www.firstnet.co.za/knowledge/voice/what-features-does-a-managed-cloud-pbx-include/. Reviewed 2026-10-10. #### What happens to FirstNet cloud voice calls during load-shedding? Cloud voice keeps working during load-shedding as long as your site's network equipment stays powered. The phone system runs in the cloud, so the weak point is the router, switches and phones on your premises, which is why FirstNet checks UPS runtime as part of deployment readiness. What FirstNet checks before go-live: - UPS runtime for the comms cabinet, covering the switch, router and any PoE injectors. - Desk-side UPS cover at reception and the switchboard, so the lines callers reach first stay up. - PoE switching for desk phones, so handsets draw power from the protected switch instead of separate power adapters. - Enough runtime for reception, switchboard and sales desks to stay up through higher load-shedding stages. Softphones add another layer. On FirstNet Managed Cloud PBX, the Linkus mobile and desktop apps let staff make and receive calls on the business number from anywhere, including from home or on the road, so calls can still be answered away from an affected office. Where a gap is found, FirstNet's voice engineers recommend a fix, such as a UPS or inverter sized to the comms cabinet load, before cutover. URL: https://www.firstnet.co.za/knowledge/voice/what-happens-to-voice-during-load-shedding/. Reviewed 2026-10-10. #### What happens with FirstNet Truecaller for Business if our customers don't have Truecaller? Nothing changes for them. Calls to people without Truecaller behave exactly as they do today, with no degraded experience. Truecaller is a top-five communication app in South Africa, so a meaningful share of your customers will see your verified identity, and that reach grows as adoption grows. Who sees what: - Recipients with Truecaller on Android or iOS see your business name, logo, category tag, green verified badge and the call reason while the phone rings. - Recipients without Truecaller see your number as they would today. - Calls connect normally on every network, because Truecaller for Business is a presentation and trust layer, not a replacement for your telephony. Because reach is never 100%, FirstNet does not promise a reach figure for your customer base. Instead, a pilot on one or two priority numbers measures answer rates against your own baseline, and the analytics dashboard shows answer rates, time-slot patterns and spam-report trends over time. If you also message customers, Verified Message ID can extend your verified identity to SMS for one-time PINs, payment alerts and delivery notices, so recognition is not limited to voice calls. URL: https://www.firstnet.co.za/knowledge/voice/what-if-my-customers-dont-have-truecaller/. Reviewed 2026-10-10. #### What internet connection do I need for business VoIP calls with FirstNet? You need an uncontended internet link, ideally dedicated fibre, with enough headroom for your busiest hour of calls. FirstNet plans for roughly 100 Kbps per concurrent call plus a 20% buffer, and checks the link before any voice deployment. The targets FirstNet's voice engineers work to: - One-way latency under 150 ms, jitter under 30 ms and packet loss under 1%. - Voice traffic prioritised end to end with QoS (DSCP EF), from the LAN switches and router through to the provider handoff. Partial QoS does little. - Bandwidth sized to peak concurrent calls, not headcount, and checked against current utilisation. As a worked example, 20 concurrent calls at 100 Kbps is 2 Mbps, so with the 20% buffer the link needs about 2.4 Mbps of headroom for voice. If your link is anything other than dedicated fibre, FirstNet can run a 24-hour line monitor that measures jitter, latency and loss before you commit. Where a gap shows up, the usual fix is dedicated internet access (DIA) or SD-WAN with multi-link bonding. When you also take FirstNet connectivity, FirstNet engineers QoS end to end; best-effort internet works, but call quality cannot be guaranteed. URL: https://www.firstnet.co.za/knowledge/voice/what-internet-connection-do-i-need-for-business-voip/. Reviewed 2026-10-10. #### What is Microsoft Teams Direct Routing, and how does FirstNet deliver it? Direct Routing connects your Microsoft Teams tenant to the phone network through Session Border Controllers (SBCs). With FirstNet, the SBCs are FirstNet-owned and Microsoft-certified, so you need no SBC hardware or separate SBC vendor, and FirstNet manages them end to end. What FirstNet Direct Routing offers: - A carrier-agnostic design, so you can keep an existing carrier or use FirstNet's ICASA-licensed SIP trunk. - Custom routing, including location-based routing, custom voice routing policies and multi-tenant scenarios. - Coexistence with an on-premises PBX, analogue lines via ATAs, paging, fax and common area phones. - TLS 1.2 encrypted signalling and SRTP encrypted media. - Resilience options from a standard SBC to an HA pair or geographically diverse SBC clusters. - Numbers ported in, or newly issued from FirstNet's own allocations. Deployment follows five phases: prepare (tenant readiness, certificates, firewall and NAT), plan (dial plans and routing), provision (tenant and SBC configuration, porting), pilot (end-to-end test calls and pilot users) and production (full cutover and handover to support). Direct Routing suits organisations with these more complex requirements. Where none apply, Operator Connect is simpler, and the two can run side by side in one tenant. URL: https://www.firstnet.co.za/knowledge/voice/what-is-microsoft-teams-direct-routing/. Reviewed 2026-10-10. #### What is Microsoft Teams Operator Connect, and how does FirstNet provide it? Operator Connect lets you add a phone operator to Microsoft Teams directly from the Teams Admin Center. FirstNet is a Microsoft-curated Operator Connect partner: you select FirstNet, and numbers, call routing and support flow through FirstNet, with no SBC to buy or host. What Operator Connect with FirstNet includes: - Calls from the Teams desktop, mobile and web clients, with no separate softphone. - Numbers assigned, ported and managed in the Teams Admin Center, alongside any Microsoft Calling Plan numbers. - Direct peering between FirstNet and Microsoft through Azure Peering Services (MAPS), engineered for call quality rather than best-effort internet. - FirstNet-managed PSTN connectivity and SBCs on FirstNet's ICASA-licensed network. - Voice Bundles or Voice Rate Options, on 12, 24 or 36-month terms. Operator Connect is designed to be set up in days rather than weeks. It suits Microsoft 365 organisations that already use Teams and want to bring calling into it, including hybrid and mobile workforces. It does not currently support common area phones, meeting room devices or analogue devices through ATAs, so FirstNet adds Direct Routing in the same tenant where those are needed. Optional add-ons include compliance recording through CallCabinet, powered by Smarsh. URL: https://www.firstnet.co.za/knowledge/voice/what-is-microsoft-teams-operator-connect/. Reviewed 2026-10-10. #### What is a SIP trunk, and what do you get with a FirstNet SIP trunk? A SIP trunk is an internet-protocol voice line that connects your phone system (PBX) to the public telephone network, in place of copper lines. FirstNet SIP Trunks add channels, numbers and a voice plan. Instead of one physical line per call, a SIP trunk carries many calls over a data connection. FirstNet SIP Trunks give you a set number of concurrent voice channels, phone numbers and a voice plan, delivered over FirstNet's ICASA-licensed (ECNS/ECS) network. The trunks work with any SIP-compliant PBX, on-premises or cloud-hosted. What a FirstNet SIP trunk includes: - Concurrent voice channels sized to your peak simultaneous calls. - Phone numbers, either ported in from your current carrier or newly issued by FirstNet. - A voice plan, either Voice Bundles with inclusive minutes or Voice Rate Options with per-minute rates, billed per second. - A free backup SIP trunk with automatic failover if you also take FirstNet connectivity. - SIP over TLS and SRTP encryption where your PBX supports it. - 24x7 South African-based support and a published SLA on FirstNet-managed components. How it works: your PBX sets up a SIP session with FirstNet's voice core, which runs on dual PortaOne clusters with zero-downtime updates. Calls then reach Telkom, Vodacom, MTN, Cell C and other operators through interconnect agreements, with multiple upstream interconnects for resilience and best-path routing. What is free: the backup trunk. Customers who take FirstNet SIP Trunks together with FirstNet connectivity get it at no extra charge. It runs on a separate logical path, and if the primary trunk loses signalling, calls reroute to it automatically. Standalone SIP customers whose internet comes from another provider can add a backup trunk as a separate line item. Sizing and compatibility: channels follow your peak concurrent calls, not headcount, so a business with 50 staff may need only a fraction of that. FirstNet plans bandwidth at about 100 Kbps per concurrent call plus 20% headroom. Most modern IP-PBXs work out of the box, including Yeastar, Cisco, Avaya IP Office, Mitel, FreePBX, 3CX, Asterisk and Panasonic, with G.711 as the baseline codec. Older PRI, BRI or analogue systems connect through a media gateway. Commercially, channels are a monthly operating cost on 12, 24 or 36-month terms, calls are billed per second on your voice plan, and once-off items such as installation and number porting are quoted separately. When comparing SIP trunk providers, check: - Whether the provider holds its own ICASA ECNS and ECS licences, since only licensees can hold and terminate South African geographic numbers. - How calls reach other networks, and whether failover to a backup trunk is automatic. - Encryption, fraud controls such as destination blocking, and spending controls. - Where support is based and what the SLA actually covers. You can prove call quality before committing: a small FirstNet SIP trunk can run in parallel into your existing PBX, and the rest of the migration follows at your own pace. URL: https://www.firstnet.co.za/knowledge/voice/what-is-a-sip-trunk/. Reviewed 2026-10-11. #### What is a cloud PBX, and how does FirstNet deliver one? A cloud PBX is a hosted business phone system with no PBX hardware on site. FirstNet delivers one as FirstNet Managed Cloud PBX, a fully managed service. PBX stands for private branch exchange: the part of a phone system that runs extensions, call routing, voicemail and queues. In a cloud PBX, also called a hosted PBX or cloud PABX, that software runs on a provider's platform, and calling, collaboration and unified communications features reach your users over the network. With FirstNet Managed Cloud PBX, FirstNet designs, deploys, ports and runs your telephony, so your team uses the phone system rather than maintaining it. How a cloud PBX differs from an on-premises system: - Extensions, users and call flows are set up in the cloud, so you can add users and branches without new hardware. - Staff make and receive calls on desk phones, or on mobile and desktop softphone apps from anywhere. - IVR, queues, voicemail-to-email, recording and reporting are part of the platform. - Costs move from hardware purchases to a predictable per-user monthly cost. - Multi-site businesses get central management and numbering. What FirstNet Managed Cloud PBX includes: - Extensions, call routing, voicemail, hold music and presence. - IVR menus, call queues, call recording and standard reporting. - Linkus mobile and desktop softphone apps, using the same business number in the office, on the road or at home. - SIP trunking and full number porting, with local South African call termination. - Standard support and platform operations as part of the per-user service. Optional add-ons are FirstNet AI Receptionist, which answers calls 24/7 in 34 languages, and FirstNet AI Transcription, along with Microsoft Teams calling integration, CRM integrations such as HubSpot and Salesforce, and contact-centre wallboards. The service is built on the Yeastar P-Series platform, hosted in South Africa for low latency and connected to FirstNet's ICASA-licensed (ECNS/ECS) voice network for local call termination. FirstNet is South Africa's number one Yeastar hosting partner. One contract and one bill cover the PBX, SIP trunking, numbers, softphones and optional AI add-ons, from small businesses to multi-site enterprises. Contracts run for 12, 24 or 36 months, with billing aligned to the users actually licensed each month. Moving from an older on-premises PBX, including 3CX, Mitel and similar systems, runs in four stages: design, number porting, deployment and handover to a named support team. It includes full number porting and a choice of cutover: phased, with old and new systems side by side while users move in waves, or a single weekend for smaller sites. What you still provide: - A finalised user list, a signed Letter of Authority for your numbers and an agreed change window. - An uncontended internet link with about 100 Kbps per concurrent call plus 20% headroom, which FirstNet checks before go-live. - Firewall changes: SIP ALG disabled and RTP ports open. - PoE switching for desk phones, and UPS cover for the comms cabinet during load-shedding. - A decision on which calls to record, with a POPIA consent prompt on recorded lines. A cloud PBX is not the only route. If your current PBX still has life in it, FirstNet SIP Trunks can connect it instead, and if your staff already work in Microsoft Teams or Zoom, FirstNet can make that the phone system. Numbers can be ported out again later, so the choice does not lock you in. URL: https://www.firstnet.co.za/knowledge/voice/what-is-a-cloud-pbx/. Reviewed 2026-10-11. #### What is a telecom management system, and what does FirstNet Apex BI Clarity do? A telecom management system (TMS) collects call records and usage data and turns them into cost, activity and performance reports. FirstNet Apex BI Clarity is Apex BI's TMS, delivered by FirstNet as a co-branded service, and it reads call detail records from your PBX and Microsoft Teams calling data through the Graph API. What Clarity shows: - Spend by department, cost centre, project, site or extension, with chargeback. - Call analytics such as call duration, abandonment, agent performance and queue statistics. - Live wallboards with queue, longest-wait, agent availability and calls-in-progress views. - Threshold alerts and exception reports to prevent bill shock. - An immutable call-activity record that supports POPIA, FSCA, healthcare and education audits. The Clarity suite has four modules: Clarity for PBX and Clarity for MS Teams, plus the adjacent Clarity for Mobile and Clarity for IoT modules, which cover mobile voice and data costs and IoT sensors and trackers. Because FirstNet delivers both the voice service and Clarity, you get one contract, one bill and one escalation path. Clarity suits finance teams that recharge telecom costs, contact centres that need live visibility and organisations running a mix of PBX and Teams. URL: https://www.firstnet.co.za/knowledge/voice/what-is-a-telecom-management-system/. Reviewed 2026-10-10. #### What is an AI receptionist, and how does FirstNet AI Receptionist work? An AI receptionist is a virtual receptionist that answers calls 24/7 and understands what callers say in natural language. FirstNet AI Receptionist, also called the Digital Receptionist, works out the caller's intent, answers from your own knowledge base and acts on the call by routing it, capturing a callback or handing over to a person. What makes it agentic rather than a basic IVR: - Callers speak naturally instead of pressing keypad options. - It answers from your PDFs, documents, website pages and FAQs, not a generic script. - It takes action: routing to a department, queue or extension, capturing a callback or escalating. - Complex or sensitive calls are handed to a human agent in the Linkus app. - Every call produces a transcript and AI summary. - It supports 34 languages with a customisable voice, tone and persona. The AI Receptionist runs on FirstNet Managed Cloud PBX and has been generally available since 15 April 2026. It suits after-hours, overflow, holiday cover and high-volume routing, and is set up in four steps: create the extension, customise the voice and persona, train it on your knowledge base, then test and publish. URL: https://www.firstnet.co.za/knowledge/voice/what-is-an-ai-receptionist/. Reviewed 2026-10-10. #### What is legal hold for call recordings, and how does FirstNet handle it? Legal hold preserves specific call recordings beyond their normal retention period, typically for litigation, disputes or regulatory inquiries. In FirstNet Compliance Recording, held recordings are kept past their scheduled deletion, and when the hold is released they are disposed of through logged, defensible deletion. How it works: - Normal retention policies delete recordings when their period ends. - A hold on specific recordings suspends that deletion for as long as the matter is open. - Access to held recordings follows role-based permissions with MFA, and every action is captured in the audit log. - Recordings can be shared with legal counsel, auditors or regulators through controlled, logged sharing. - When the hold is lifted, deletion follows policy and is logged, so you can show what was removed and when. Legal hold is included from the Core Recording tier upwards. During design, FirstNet agrees who may place and release holds, for example Compliance, Legal or IT, and legal-hold actions go through change control. With the optional Managed Compliance Service, FirstNet administers legal hold on your behalf. Without legal hold, a recording that has reached the end of its retention period could be deleted while a dispute is still running. URL: https://www.firstnet.co.za/knowledge/voice/what-is-legal-hold/. Reviewed 2026-10-10. #### What is the FirstNet Smartz Contact Centre? FirstNet Smartz Contact Centre is a cloud contact centre (CCaaS) and customer-experience platform from Smartz Solutions, delivered and supported by FirstNet on one contract. One Smartz Suite tenant has four modules: Commz for omnichannel engagement, Engage for workforce management, Analyz for analytics and reporting, and Smartz Academy for role-based training. What each module does: - Commz: inbound voice with multi-level IVR and skills-based routing, an outbound dialler suite, and SMS, WhatsApp, web chat, email, Telegram and Meta Messenger, all in the Chatterbox agent desktop. - Engage: quality assurance, time and attendance, leave, e-learning, recruitment and HR records for the contact-centre team, alongside your payroll system rather than replacing it. - Analyz: more than 25 dashboards and 200 reports out of the box, CSAT, NPS and CES, near-real-time wallboards and scheduled reports. - Smartz Academy: learning paths for agents, supervisors, administrators and analysts, with certificates. You can start with any module and expand. Smartz sits on top of the voice service FirstNet supplies on the same contract, whether that is Yeastar cloud PBX, FirstNet SIP trunks, Microsoft Teams calling or your existing PBX. Smartz Solutions is Johannesburg-based and hosts the platform in South Africa, and FirstNet's Voice Solutions Engineering team runs onboarding end to end. URL: https://www.firstnet.co.za/knowledge/voice/what-is-the-firstnet-smartz-contact-centre/. Reviewed 2026-10-10. #### What is the Zoom Provider Exchange, and what is FirstNet's role in it? The Zoom Provider Exchange is Zoom's curated marketplace of certified phone-network partners. FirstNet is listed as a South African Cloud Peering partner, also called bring your own carrier (BYOC), so your Zoom admin can select FirstNet and connect South African numbers and call termination to your Zoom tenant without a separate carrier portal. How enablement works: - Your Zoom admin, or FirstNet on your behalf, selects the FirstNet listing in the Provider Exchange. - FirstNet accepts the request and scopes network readiness, licences, numbers and porting. - FirstNet enables Cloud Peering on your tenant, including SIP termination, number bindings and dial plans. - Numbers are newly issued by FirstNet or ported in, with a Letter of Authority and rollback plan. - Pilot users go live with hyper-care, followed by full rollout. Calls then reach local operators through FirstNet's ICASA-licensed interconnects. Outbound calls from Zoom route to FirstNet and on to the destination network, while inbound calls to FirstNet numbers are presented to the user, queue or auto attendant set up in Zoom. The same model applies to Zoom Contact Centre, where FirstNet provisions contact-centre service numbers and assigns them to queues, so both products share one voice provider. URL: https://www.firstnet.co.za/knowledge/voice/what-is-the-zoom-provider-exchange/. Reviewed 2026-10-10. #### What is the difference between FirstNet Core, Advanced and Conversation Analytics recording? FirstNet Core Recording covers secure call capture and governance. Advanced adds quality assurance (QA) workflows for supervisors, and Conversation Analytics adds transcription, redaction and sentiment on top. Each tier includes the one below it: - Core Recording: compliant capture with AES-256 rotating encryption, MFA, fine-grained permissions, retention rules, legal hold, compliant call sharing and audit logs. It suits governance-led needs in regulated sectors. It has no QA workflow, analytics or screen capture. - Advanced Recording: adds QA and evaluation workflows, supervisor playback and tagging, richer call details, advanced reports and optional screen capture. It suits contact centres with structured QA programmes. - Conversation Analytics: adds transcription in many languages, summaries, and sentiment and voice analysis. It also automates PCI, PII and PHI redaction, plus QA scorecards and dashboards. It suits dispute defence, coaching and redaction at scale. - Managed Compliance Service: optional on any tier. FirstNet runs policy, retention, legal hold and user setup, and helps with audit evidence. A practical rule: start with Core when you only need governance. Step up to Advanced when QA, evaluation or screen capture is in scope. Choose Conversation Analytics when you clearly need transcription, redaction or sentiment. You can mix tiers too: Core for office users, say, and Advanced for the contact centre. URL: https://www.firstnet.co.za/knowledge/voice/what-is-the-difference-between-core-advanced-and-conversation-analytics-recordin/. Reviewed 2026-10-10. #### What is the difference between Teams Operator Connect and Direct Routing at FirstNet? Operator Connect is the simpler option: you select FirstNet as your operator in the Teams Admin Center and there is no SBC to buy or configure. Direct Routing gives more control for complex estates, using FirstNet-owned, Microsoft-certified SBCs that can work with any carrier. How they compare: - Set-up: Operator Connect is typically live in days rather than weeks; Direct Routing needs SBC design and routing configuration. - Carrier: Operator Connect uses FirstNet as the carrier; Direct Routing is carrier-agnostic, so you can keep an existing carrier. - Devices: Operator Connect does not currently support common area phones, meeting room devices or analogue devices via ATAs; Direct Routing does. - Routing: Direct Routing handles location-based routing, custom dial plans, multi-tenant scenarios and coexistence with an on-premises PBX. - Call path: Operator Connect peers directly with Microsoft via Azure Peering Services; Direct Routing uses TLS 1.2 signalling and SRTP media. Both run on FirstNet's ICASA-licensed network and can run side by side in the same tenant. FirstNet starts with the simplest option that fits your requirements and adds Direct Routing only where it is needed. URL: https://www.firstnet.co.za/knowledge/voice/what-is-the-difference-between-operator-connect-and-direct-routing/. Reviewed 2026-10-10. #### What is the difference between Zoom Contact Centre Essential, Premium and Elite? Essential is for voice-first teams, Premium adds digital channels, and Elite adds advanced AI and workforce management. Zoom Contact Centre is licensed per agent, and FirstNet supplies the South African voice, numbers and implementation for every tier. - Essential: voice queues, basic IVR, agent and supervisor consoles, native Zoom Phone integration, real-time and historical reporting and call recording. Suits voice-first and smaller deployments. - Premium: everything in Essential plus webchat, SMS, social and inbound email in one agent console, basic workforce engagement and expanded dashboards. Suits mid-market teams working across several channels. - Elite: everything in Premium plus sentiment analysis, automatic call summaries, real-time agent assist, advanced workforce management, advanced analytics and broader compliance features. Suits enterprise contact centres. - Zoom Virtual Agent: AI self-service across voice, chat and messaging that escalates to a human agent when needed, sold standalone or as an add-on. Zoom Quality Management is available as an add-on on Premium and Elite. The right tier depends on your channel mix, AI needs and workforce management requirements, and FirstNet scopes it during design. As a guide, voice-only Essential deployments typically take 4 to 6 weeks to implement, while complex omnichannel Elite deployments take 12 to 16 weeks. URL: https://www.firstnet.co.za/knowledge/voice/what-is-the-difference-between-zoom-contact-center-essential-premium-and-elite/. Reviewed 2026-10-10. #### What is the difference between a cloud PBX, SIP trunks and Microsoft Teams calling? A cloud PBX replaces your whole phone system, SIP trunks connect a phone system you already own to the public network, and Teams calling turns Microsoft Teams into your phone. FirstNet offers all three on its own ICASA-licensed voice network. - Cloud PBX: FirstNet Managed Cloud PBX is a fully managed phone system with extensions, IVR, call queues, call recording, standard reporting and Linkus mobile and desktop softphones. It suits businesses replacing an ageing on-premises PBX, with optional AI Receptionist and AI Transcription. - SIP trunks: FirstNet SIP Trunks connect any SIP-compliant PBX, on-premises or cloud-hosted, to the public telephone network. You keep your PBX, and FirstNet connectivity customers get a free backup trunk. - Teams calling: Operator Connect adds phone numbers to Teams with no SBC on site. Direct Routing uses FirstNet-managed SBCs and keeps an existing carrier, custom routing or analogue devices in the picture. The right choice usually depends on where your users already work and what you need to keep. The options also combine: a SIP trunk can sit under an existing PBX while other users move to Teams or Zoom Phone, and you can move from SIP trunks to Managed Cloud PBX or Teams later without changing the trunk underneath. URL: https://www.firstnet.co.za/knowledge/voice/what-is-the-difference-between-a-cloud-pbx-sip-trunks-and-microsoft-teams-callin/. Reviewed 2026-10-10. #### What is the uptime SLA for the FirstNet Smartz contact centre? The Smartz Suite is backed by a 99.9% monthly availability SLA. If the suite is unavailable, response is within 30 minutes with a 4-hour target to restore. You log faults with FirstNet Support, which escalates to the Smartz service desk, so you have one point of contact. How faults are prioritised: - Level 1, suite unavailable: 30-minute response and a 4-hour target to restore. - Level 2, partial outage: 1-hour response and an 8-hour target to restore. - Level 3, some functions impacted: 2-hour response and a 1-day target to restore. The 99.9% figure is a monthly average for the Smartz Suite itself. Your voice service underneath, such as FirstNet SIP trunks or Managed Cloud PBX, is covered by FirstNet's own voice SLA on the same contract. Call quality also depends on each agent's connection meeting the 2 Mbps and 300 ms requirements. Support runs through one path: FirstNet Support first, then the Smartz Solutions service desk, with further escalation inside Smartz Solutions where needed. You do not have to work out which vendor owns a fault. The full service levels are set out in the Smartz SLA annexures that form part of your contract. URL: https://www.firstnet.co.za/knowledge/voice/what-is-the-uptime-sla-for-the-smartz-contact-centre/. Reviewed 2026-10-10. #### What is verified business caller ID with FirstNet Truecaller for Business? Verified business caller ID shows your brand on the recipient's phone when you call: your business name, logo, a green verified badge, a category tag and the reason for the call. FirstNet Truecaller for Business delivers it as a managed service on the Truecaller network, so recipients see who is calling and why before they answer. What the recipient sees during the ring: - Your business name, logo and category tag. - A green verified badge confirming that the number and brand are genuine. - A call reason, such as a payment reminder or delivery update. Why it matters: unsaved numbers are increasingly treated as spam, and many people decline calls they do not recognise. A verified identity separates your calls from spoofed or community-suggested entries, and because the profile is locked, impersonators cannot change it. It works on Android and iOS phones where Truecaller is installed; everyone else receives your calls as normal. It suits outbound teams in collections, healthcare appointments and results, deliveries, outbound sales and high-volume contact centres. FirstNet handles verification, brand set-up, call reasons, the analytics dashboard and support. Optional extras include Video Caller ID, Call Me Back, User Feedback and Verified Message ID for SMS. URL: https://www.firstnet.co.za/knowledge/voice/what-is-verified-business-caller-id/. Reviewed 2026-10-10. #### What is voice as a service, and does FirstNet offer it? Yes. Voice as a service means buying business calling as a managed subscription instead of owning phone system hardware. FirstNet offers it as cloud PBX, SIP trunks and Teams or Zoom calling. The provider runs the platform, the numbers and the connection to the phone network, and you pay a predictable operating cost rather than buying equipment. FirstNet runs every option on its own ICASA-licensed (ECNS/ECS) voice network, with interconnects to all major South African operators. The FirstNet options: - FirstNet Managed Cloud PBX: a fully managed phone system on Yeastar P-Series, hosted in South Africa, with IVR, queues, recording and Linkus softphones. - FirstNet SIP Trunks: channels, numbers and a per-second voice plan for a PBX you already own. - Microsoft Teams calling through Operator Connect or Direct Routing, so Teams becomes the phone. - Zoom Phone and Zoom Contact Centre, with FirstNet supplying South African numbers and call termination. - A cloud contact centre with omnichannel engagement, workforce management and analytics. What changes: on-site PBX hardware falls away, pricing is per user, and adding users or branches becomes a configuration change rather than a hardware project. FirstNet designs, ports and runs the service under one contract, one bill and one escalation path. What you still provide: an internet link with about 100 Kbps per concurrent call plus 20% headroom, voice prioritised with QoS, UPS cover for network equipment during load-shedding, and a signed Letter of Authority to port your existing numbers. FirstNet's voice engineers check these before go-live. URL: https://www.firstnet.co.za/knowledge/voice/what-is-voice-as-a-service/. Reviewed 2026-10-11. #### What must be set up in Microsoft 365 before FirstNet Teams calling goes live? Your tenant must be in Teams-Only mode, users need Teams Phone Standard or E5 licences, and someone with Global Admin access must be available for the integration window. FirstNet reviews tenant readiness first and gives you a checklist of anything to fix. The readiness checklist typically covers: - Teams-Only mode in the tenant. - Licensing inventory: Teams Phone Standard or E5 per user, plus Audio Conferencing where relevant. - Tenant ownership and federation settings. - Existing voice routing, dial plans and any Calling Plan numbers. - For Direct Routing: a public FQDN, a certificate plan, and firewall and NAT changes for signalling and media. - Porting: a signed Letter of Authority and the list of numbers to move. During provisioning, FirstNet either adds itself as your operator in the Teams Admin Center for Operator Connect, or configures the tenant side for Direct Routing, including PSTN gateway registration, voice routing policies, voice routes, PSTN usages and dial plans. Auto attendants, call queues and dial plans are then built before pilot users cut over and are tested. If you are not licensed yet, FirstNet can supply Teams Phone licences as a Microsoft CSP. URL: https://www.firstnet.co.za/knowledge/voice/what-must-be-set-up-in-microsoft-365-before-teams-calling-goes-live/. Reviewed 2026-10-10. #### What network and computers does the FirstNet Smartz contact centre need? Smartz is browser-based and runs in Chrome, Brave, Firefox or Edge. Each agent needs at least 2 Mbps (4 Mbps preferred) with latency under 300 ms, and a desktop with a quad-core 2.6 GHz CPU, 8 GB RAM (16 GB preferred) and an SSD. FirstNet confirms your network, ports and endpoints before go-live. The full environment checklist: - Browser: Chrome, Brave, Firefox or Edge. - Bandwidth: 2 Mbps per agent minimum, 4 Mbps preferred, with latency under 300 ms. - Desktop: quad-core 2.6 GHz CPU, 8 GB RAM (16 GB preferred), a 256 GB SSD and at least a 1024 x 768 display. - Firewall ports: 443 TCP for the browser, 5060 to 5062 for SIP, 8088 and 8089 for WebRTC, and defined UDP ranges for real-time media. - Wallboards: browser-rendered on screens you supply. As a worked example, a 30-agent floor needs at least 60 Mbps for Smartz, and 120 Mbps to meet the preferred figure. Connections with latency above 300 ms do not meet the requirements. Dashboards and wallboards refresh in near real time rather than sub-second. FirstNet's Voice Solutions Engineering team validates the port list, bandwidth and endpoints with you during scoping, so any gaps are fixed before agents go live. URL: https://www.firstnet.co.za/knowledge/voice/what-network-and-computers-does-the-smartz-contact-centre-need/. Reviewed 2026-10-10. #### What resilience options does FirstNet offer for Microsoft Teams Direct Routing? FirstNet matches Direct Routing resilience to how critical each site is: a standard managed SBC for single-site or non-critical calling, a high-availability SBC pair for critical and multi-site organisations, or full geographic redundancy across two FirstNet SBC clusters. The options in more detail: - Standard SBC: a single managed SBC set-up for single-site or non-critical Teams calling, where moderate downtime is tolerable. - HA SBC pair: load-shared, geographically diverse SBCs for critical sites, multi-site enterprises and businesses where downtime has a material impact. - Geographic redundancy: full high availability across two FirstNet SBC clusters, with a resilient SIP path, where the exposure justifies it. - Connectivity: primary and backup internet links between your sites and Microsoft 365, because the voice path is only as resilient as that underlay. FirstNet operates two geographically diverse SBC clusters with load-shared traffic, which form the backbone of the HA designs. Resilience is scoped per site, never assumed by default. A higher resilience tier improves the design but does not change the contractual SLA, which covers the FirstNet-managed SBCs, SIP trunk, number provisioning and support. Microsoft's Teams service sits outside FirstNet's SLA, although FirstNet manages the joint escalation for you. URL: https://www.firstnet.co.za/knowledge/voice/what-resilience-options-are-there-for-teams-direct-routing/. Reviewed 2026-10-10. #### What telecom savings can we expect from FirstNet Apex BI Clarity? FirstNet does not promise a fixed percentage, because savings depend on your estate. Customers commonly find recoverable spend such as mis-billed extensions, under-used services and out-of-policy usage, and the first month's report quantifies it for your business. Where savings typically come from: - Mis-billed extensions that are being charged incorrectly. - Under-used lines and services across branches that can be consolidated. - Out-of-policy usage that policy rules and alerts can reduce. - Plans and add-ons that can be right-sized to actual usage. - Bill shock avoided through threshold alerts and exception reports. Beyond direct savings, chargeback by department, cost centre or project shows each budget holder their own telecom spend, and usage trends inform procurement and planning decisions. To size the opportunity, Clarity needs your call data: the PBX CDR feed and, for Teams, Graph API access. Reports are tuned over 2 to 4 weeks after data starts flowing, so the first full month gives a grounded view of what can be recovered. If you want mobile costs in scope too, the adjacent Clarity for Mobile module covers mobile voice and data spend. URL: https://www.firstnet.co.za/knowledge/voice/what-savings-can-we-expect/. Reviewed 2026-10-11. #### What will call quality be like on Zoom Phone with FirstNet voice? FirstNet engineers the voice path it controls: ICASA-licensed termination, South African interconnects and fraud-monitored routing. Quality on your own internet, LAN and Wi-Fi depends on bandwidth, jitter and packet loss, which FirstNet checks before deployment. What FirstNet checks before go-live: - Bandwidth on your internet link, planned at about 100 Kbps per concurrent call plus 20% headroom. - Latency, jitter and packet loss against voice targets: one-way latency under 150 ms, jitter under 30 ms and loss under 1%. - Firewall, NAT and edge configuration. - Quality of service at the access layer, so voice traffic is prioritised. - Endpoints such as headsets, USB phones or soft clients, and home-worker connectivity for hybrid staff. FirstNet does not claim a guaranteed MOS (Mean Opinion Score) over best-effort internet. It engineers the path it controls and documents the dependencies on the path it does not. Where your connection is the weak point, FirstNet managed connectivity, such as fibre, SD-WAN or wireless backup, can strengthen the underlay. A pilot group on Zoom Phone also proves quality on your own network before the full rollout. URL: https://www.firstnet.co.za/knowledge/voice/what-will-call-quality-be-like/. Reviewed 2026-10-10. #### Where does FirstNet Apex BI Clarity store our call data? Clarity stores call metadata in the Apex BI cloud. Access controls, audit trail and retention settings are documented in FirstNet's service terms to support your POPIA programme. What Clarity holds and how it is governed: - Data stored: call metadata from PBX call detail records and Microsoft Teams Graph API data, such as call times, durations and costs, rather than call audio. - Access: role-based access, so people see the reports relevant to their role. - Audit: an auditable record of call activity and policy enforcement. - Retention: retention settings are agreed during scoping and documented in the service terms. - Residency: data residency and processing geography are set out transparently before you commit. Because Clarity records call activity rather than conversations, it is not a call recording archive. If you need the conversations kept for regulatory purposes, FirstNet Compliance Recording is the counterpart, with tamper-proof storage, legal hold and retention policies, and together they cover the full audit picture. FirstNet does not claim guaranteed compliance. Clarity supports your POPIA, FSCA, healthcare or education audit programme, but your own policies decide the outcome. Support, including escalation to Apex BI on platform issues, runs through FirstNet as your single point of contact. URL: https://www.firstnet.co.za/knowledge/voice/where-is-call-data-stored/. Reviewed 2026-10-10. #### Where is FirstNet Compliance Recording data hosted? Hosting location and data residency are confirmed during solution design, based on your regulatory and contractual needs, and then documented in the design and your contract. FirstNet does not commit to a hosting location before that review. How residency is decided: - In discovery, FirstNet captures whether you need in-country or regional hosting, any data sovereignty constraint and any residency wording in your client contracts. - FirstNet's voice engineers review platform fit and residency as part of solution design. - The agreed hosting and residency are written into the solution design and contract, so they can be audited later. - Your data-processing terms are signed in a Data-Processing Addendum before onboarding. Wherever recordings are hosted, they sit in tamper-proof storage with AES-256 rotating encryption at rest and in transit, MFA on admin and reviewer access, granular permissions and audit logs. Onboarding, configuration and support are delivered locally by FirstNet. If your policies or client contracts require South African residency, raise it at the start of the conversation so it shapes the platform choice and design rather than being added later. URL: https://www.firstnet.co.za/knowledge/voice/where-is-our-data-hosted/. Reviewed 2026-10-10. #### Where is FirstNet Smartz contact centre data hosted, and who owns it? You own your data. Smartz Solutions is a Johannesburg-based company that hosts the platform in South Africa and is POPIA-aligned, and you can export reports to Excel, CSV or PDF at any time. How your data is protected and controlled: - Hosting: the Smartz Suite is hosted in South Africa by Smartz Solutions, with FirstNet as the local prime contractor. - Access: a permission matrix, single sign-on, two-factor authentication by email PIN or voice print and after-hours login restrictions. - Audit: a full audit trail, with every export and recording playback logged. - Voice biometrics: sensitive information is blurred during playback and stored in encrypted columns. - Export: reports and data export from the Analyz portal to Excel, CSV or PDF, with scheduled email delivery. Because the platform is POPIA-aligned and hosted in-country, it suits South African organisations that want contact-centre data to stay local. POPIA compliance itself still depends on how you configure the platform, assign access rights and handle consent. For regulated call recording, such as FAIS or FSCA obligations, FirstNet pairs Smartz with CallCabinet or Smarsh compliance recording on the same contract, with hosting and residency for those recordings confirmed during solution design. URL: https://www.firstnet.co.za/knowledge/voice/where-is-smartz-contact-centre-data-hosted-and-who-owns-it/. Reviewed 2026-10-10. #### Which South African regulations does FirstNet call recording support, such as POPIA and FAIS? FirstNet Compliance Recording supports compliance programmes for South Africa's POPIA, FAIS and FICA by aligning recording retention and access controls with these regulations and your internal policies. Final compliance depends on your own policies, configuration and obligations. How the controls map to local requirements: - POPIA: disclosure and consent prompts on recorded lines, role-based access with MFA, full audit trails and retention that ends in logged, defensible deletion. - FAIS: advice calls kept in tamper-proof storage for the period your regulator or policy requires; five years is common for FSCA and FAIS-regulated firms. - FICA: recordings of inbound verification calls can be kept, searched and retrieved where your FICA processes rely on them. - Card payments: automated PCI-DSS card-data redaction from audio and transcripts with the Conversation Analytics tier. Before recording starts, FirstNet confirms your retention policy and data-processing terms in writing, then designs platforms, scope, legal hold and integrations around them. The platform is designed to support your compliance programme rather than guarantee an outcome, because the result depends on how recording is configured and used. A FirstNet specialist can map your specific obligations, such as which lines must be recorded and for how long, during solution design. URL: https://www.firstnet.co.za/knowledge/voice/which-regulations-do-you-support/. Reviewed 2026-10-10. #### Which Zoom Phone licence do I need from FirstNet? Most named users need Zoom Phone Pro, which covers calling, voicemail, basic call handling, presence and the mobile, desktop and desk-phone clients. Supervisors and contact-centre-style teams add the Power Pack, and shared phones use a Zoom Phone Common Area licence. How to size licences: - Zoom Phone Pro: the default per-user licence for named users, including AI Companion features. - Power Pack: an add-on for users who need queue analytics, advanced call handling and supervisor monitor, whisper and barge. It is also required for compliance recording. - Common Area: a shared-device licence for reception, meeting-room, lobby and warehouse phones not assigned to a named user. - Add-ons: extra direct numbers, toll-free numbers, international calling bundles and, where supported, SMS. Not every user needs the Power Pack. It is usually limited to supervisors, contact-centre-adjacent teams and regulated front-office staff whose calls must be recorded. Common Area devices count toward your number inventory rather than your user headcount. FirstNet sizes the licence mix with you during design so you are neither over- nor under-licensed, and Zoom licences, FirstNet voice and numbers then appear on one FirstNet invoice. If you need full omnichannel queues, Zoom Contact Centre is licensed separately, per agent. URL: https://www.firstnet.co.za/knowledge/voice/which-zoom-phone-licence-do-i-need/. Reviewed 2026-10-10. #### Which channels does the FirstNet Smartz contact centre support? FirstNet Smartz Contact Centre supports voice (inbound and outbound), SMS, WhatsApp, web chat, email, Telegram, and Facebook and Instagram Messenger. Agents handle every channel from one desktop, Chatterbox, with shared queues, SLAs, dispositions and wrap-ups. What each channel group includes: - Inbound voice: ACD, multi-level IVR, skills-based routing, callbacks, Text2Speech and per-campaign music on hold. - Outbound voice: preview, manual, predictive, auto-voice and clicker diallers, with retries, number rotation and voicemail detection. - Messaging: keyword routing, automated replies, templates with merge data, an SLA per campaign and CSAT, NPS or CES ratings per channel. - Email: connects through IMAP, Exchange Web Services with OAuth2, Outlook or Gmail. - WhatsApp: you bring your WhatsApp Business Account and Business Solution Provider, and FirstNet wires the connector during onboarding. Chatterbox brings voice and messaging into one window, with screen-pops, CRM access, a softphone and customer-journey views. Supervisors can monitor, whisper and barge in real time. Voice biometrics, including two-factor authentication by voice print, and sentiment-aware routing are also available. For outbound campaigns, pairing the dialler with Truecaller for Business verified caller ID lets customers see who is calling before they answer. URL: https://www.firstnet.co.za/knowledge/voice/which-channels-does-the-firstnet-smartz-contact-centre-support/. Reviewed 2026-10-10. #### Which phone systems can FirstNet Compliance Recording record? FirstNet Compliance Recording captures Microsoft Teams calls and meetings, Zoom Meetings, Zoom Phone and Zoom Contact Center, PBX, SIP and unified-communications systems, and inbound, outbound and blended contact centres. Recordings from every platform go into one tamper-proof archive with one retention policy, one search and one audit trail. How capture works on each platform: - Microsoft Teams: voice and meetings, with each recording tied to the user's identity. - Zoom: Meetings, Zoom Phone and Zoom Contact Center. Recorded Zoom Phone users need the Power Pack licence. - PBX, SIP and UC: FirstNet-hosted or customer-owned PBXs, via SIPREC, port mirroring or supported gateway integrations. - Contact centres: inbound, outbound and blended, with integrations to common contact-centre platforms. - Legacy recorders: historical recordings can be migrated in with chain of custody preserved. The capture method for each PBX and contact-centre platform is validated by FirstNet's voice engineers during solution design, then connected and tested end to end before go-live. Recordings are indexed against customer and agent identifiers and can be searched by metadata, user, date, tag or, with analytics enabled, transcript. API access supports automation, archive checks and third-party analytics. URL: https://www.firstnet.co.za/knowledge/voice/which-phone-systems-can-be-recorded/. Reviewed 2026-10-10. #### Which regulations does FirstNet's call recording platform support, including PCI-DSS and GDPR? FirstNet Compliance Recording supports compliance programmes for POPIA, FAIS, FICA, PCI-DSS, MiFID II, Dodd-Frank, HIPAA, GDPR and CCPA. Final compliance still depends on your own policies, settings and duties. What each set of rules typically covers: - POPIA, FAIS and FICA: South African rules on data protection, financial advice and financial intelligence. - PCI-DSS: teams that handle cards, wherever cardholder data passes over recorded phone lines. - MiFID II and Dodd-Frank: duties to record lines and keep records in financial markets. - HIPAA and similar laws: keeping health information safe. - GDPR and CCPA: data protection for firms that operate in the EU or California. The controls start with tamper-proof storage, with AES-256 rotating encryption at rest and in transit. They also include MFA, fine-grained permissions, retention you can set, legal hold, defensible deletion, compliant call sharing and audit logs. The Conversation Analytics tier adds automatic redaction. It removes card data, personal information and health data from audio and transcripts. If you must meet rules in more than one jurisdiction, you can manage them all from one archive. You can set retention per call type or business unit. FirstNet confirms your retention policy and the terms for processing your data in writing before any recording starts. URL: https://www.firstnet.co.za/knowledge/voice/which-regulations-does-the-platform-support/. Reviewed 2026-10-10. #### Who can access call recordings stored in FirstNet Compliance Recording? Only the people you authorise. FirstNet Compliance Recording uses role-based access with multi-factor authentication (MFA) and full audit trails to control who can search, play back and retrieve recordings. How access is controlled: - Permissions can be restricted by user, group, recording type and metadata, so a supervisor can be limited to their own team's calls. - MFA is required for administrator and reviewer roles. - Audit and security logs record who accessed which recording, when and what they did, giving a chain of custody. - Sharing outside the platform, for example with auditors, regulators or legal counsel, is controlled and logged. - Single sign-on with common identity providers is supported and validated during solution design. You decide the access model during design, including which recordings Compliance, Legal, IT and supervisors may see and who may place a legal hold. FirstNet then provisions the roles, encryption and retention policies to match. Day to day, your own admins manage users, or FirstNet can do it for you through the optional Managed Compliance Service. Access changes within the contracted scope go through FirstNet's change control, and the recordings remain yours throughout. URL: https://www.firstnet.co.za/knowledge/voice/who-can-access-recordings/. Reviewed 2026-10-10. #### Who owns the call recordings stored in FirstNet Compliance Recording? You do. Your organisation owns its recordings, and an exit process with secure deprovisioning and compliant data handover is available, as defined in your contract. What ownership means in practice: - Recordings are kept in tamper-proof storage under the retention, access and legal-hold policies you set. - Your admins, or FirstNet through the optional Managed Compliance Service, control who can search and retrieve them. - Audit logs keep a chain of custody for every access and action. - API access supports your own automation, archive checks and third-party analytics. - On exit, recordings can be handed over compliantly and the service securely deprovisioned, in line with your contract. FirstNet delivers the service on the CallCabinet and Smarsh platforms and is the single accountable provider for onboarding, support and escalation. Before go-live you sign a Data-Processing Addendum and confirm your retention policy in writing, which sets out how recordings are processed on your behalf. The standard term is 12 months, and notice periods, renewal and handover obligations are defined in your contracted terms. Recordings migrated from an older recorder come across with chain of custody preserved, so their history stays intact. URL: https://www.firstnet.co.za/knowledge/voice/who-owns-the-recordings/. Reviewed 2026-10-10. #### Who qualifies for FirstNet's free backup SIP trunk? Customers who take FirstNet SIP Trunks together with FirstNet connectivity get a backup SIP trunk at no extra charge. Standalone SIP customers whose internet comes from another provider can add a backup trunk as a separate line item. How the backup trunk works: - It is provisioned on a separate logical path from your primary trunk. - If the primary trunk loses signalling for any reason, calls reroute to the backup automatically, with no manual intervention. - Both trunks run on FirstNet's dual PortaOne clusters, which receive zero-downtime updates. - Failover to the backup is tested during the pilot phase, before full cutover. FirstNet offers three levels of voice continuity. A single trunk suits single-site or non-critical voice where moderate downtime is acceptable. A primary plus free backup trunk is the standard set-up for FirstNet connectivity customers. Dual-carrier diversity, with documented failover, is designed for high-availability contact centres, treasury operations and mission-critical medical sites. FirstNet's voice engineers confirm the right backup posture for each site during solution design, and connectivity can be added at the same time if you want the free backup trunk. URL: https://www.firstnet.co.za/knowledge/voice/who-qualifies-for-the-free-backup-sip-trunk/. Reviewed 2026-10-10. #### Why buy Truecaller for Business through FirstNet rather than from Truecaller directly? FirstNet handles verification, brand set-up, call-reason changes, dashboard access and support inside your voice contract, so you deal with one provider rather than managing a separate Truecaller relationship. What FirstNet manages for you: - Verification of number ownership and business registration with Truecaller. - Brand profile set-up: name, logo, category tag, business page and call reasons. - Integrations for dynamic call reasons from your CRM, dialler or contact-centre platform, where needed. - Ongoing changes: adding numbers, updating branding or call reasons, and managing dashboard access. - Support through FirstNet's 24x7 Rapid Response service desk. Truecaller for Business can be included in FirstNet voice, hosted PBX and contact-centre solutions, so the trust layer becomes part of the voice service rather than a separate purchase. FirstNet is ICASA-licensed for ECS and ECNS, delivers under ISO 27001 and ISO 9001, and supports you locally in South Africa. It also keeps outbound calling joined up. The same provider runs your numbers, porting, voice platform and caller ID, so changes to numbers and to how they are presented are handled by one team. URL: https://www.firstnet.co.za/knowledge/voice/why-buy-through-firstnet-rather-than-truecaller-directly/. Reviewed 2026-10-10. #### Why buy Zoom Phone through FirstNet instead of directly from Zoom in South Africa? Zoom does not deliver PSTN calling in South Africa on its own, so you need a Zoom Provider Exchange partner for local numbers. FirstNet provides ICASA-licensed voice, number porting and local support, all on one invoice with your Zoom licences. What FirstNet adds as your Provider Exchange partner: - ICASA-licensed (ECNS and ECS) South African termination and origination, routed over FirstNet's interconnects with Telkom, Vodacom, MTN, Cell C and other licensees. - Set-up from inside your Zoom admin, with no separate carrier portal. - New geographic, non-geographic and toll-free numbers, plus porting in and out with a Letter of Authority and rollback plan. - Fraud monitoring with real-time call records, with premium-rate and exotic destinations blocked by default. - One FirstNet invoice for Zoom Phone Pro, Power Pack and Common Area licences, voice and numbers. FirstNet also designs and implements the service: network readiness checks, licence sizing, dial plans and emergency routing, a pilot group and a planned cutover. Support is local, in English and Afrikaans, with a 24/7 network operations centre for voice incidents, and FirstNet handles joint escalation with Zoom. Add-ons such as compliance recording, Apex BI Clarity analytics and Truecaller verified caller ID can sit on the same contract. URL: https://www.firstnet.co.za/knowledge/voice/why-not-buy-zoom-phone-directly-from-zoom/. Reviewed 2026-10-10. #### Why use FirstNet Apex BI Clarity instead of building telecom reports in Power BI? You can build telecom reporting in Power BI, but the ongoing data engineering, Microsoft Graph API schema changes and chargeback rule maintenance are where DIY projects usually stall. Clarity is a productised platform with Apex BI's product roadmap behind it, delivered and supported by FirstNet. What a DIY build has to keep maintaining: - Data pipelines from each PBX's CDR or SMDR feed, normalised across vendors and sites. - Microsoft Graph API connections, which change when Microsoft updates the API. - Chargeback rules that must follow every change to departments and cost centres. - Live wallboards for contact-centre teams. - Immutable call-activity records for POPIA, FSCA, healthcare or education audits. Clarity provides these out of the box: one view across FirstNet Hosted PBX, legacy PBXs and Teams, spend by department, cost centre, project, site or extension, call analytics, live wallboards and threshold alerts. Your team's effort is limited to a one-time Graph API consent for Teams, with the PBX feed native on FirstNet Hosted PBX. Clarity runs on 12, 24 or 36-month terms, and FirstNet is the single point of contact for support, including escalation to Apex BI, so your analysts can spend their time on the insights rather than the plumbing. URL: https://www.firstnet.co.za/knowledge/voice/cant-we-build-this-ourselves-in-power-bi/. Reviewed 2026-10-10. #### Why use FirstNet for Teams calling instead of Microsoft Calling Plans? Calling Plans are Microsoft's own PSTN service. FirstNet adds local South African termination, local number porting, local support and custom routing on an ICASA-licensed network, and both options can coexist in the same Teams tenant. What FirstNet adds: - ICASA-licensed (ECNS and ECS) South African termination, with calls routed over FirstNet's interconnects with local operators. - Local number porting run end to end by FirstNet, with a written rollback plan. - A South African support team and an SLA on FirstNet-managed components. - Custom routing through Direct Routing, such as location-based rules and custom dial plans. - Support for analogue devices, common area phones and PBX coexistence through Direct Routing. - Voice Bundles or Voice Rate Options, quoted for your traffic profile. Calling Plans can suit organisations that are happy with Microsoft's own rates and number ranges and do not need carrier flexibility. Because the services coexist, you can move users across gradually or keep some on Calling Plans, and users get the same native experience in Teams desktop, mobile and web either way. FirstNet can also supply Teams Phone licences as a Microsoft CSP and add compliance recording, Truecaller verified caller ID and Clarity call analytics on the same contract. URL: https://www.firstnet.co.za/knowledge/voice/why-not-just-buy-microsoft-calling-plans/. Reviewed 2026-10-10. #### Will FirstNet Apex BI Clarity work with our existing PBX? Yes, in most cases. FirstNet Apex BI Clarity ingests call data from a wide range of PBX and UC platforms. It is native on FirstNet Hosted PBX, and legacy PBXs are supported wherever a call detail record (CDR) or SMDR data feed is available. How support works by platform: - FirstNet Hosted PBX (Managed Cloud PBX): the call data feed is native, so your team has nothing to connect. - Legacy on-premises PBXs such as Avaya, Mitel, NEC and Panasonic: supported where CDR or SMDR access is available; some connect easily, others need a third-party adapter. - Microsoft Teams: Clarity for MS Teams uses the Microsoft Graph API, whether you call through Operator Connect, Direct Routing or Calling Plans. - Carrier and billing data: CDRs and billing data can be ingested from multiple sources to centralise cost reporting. FirstNet's voice engineers confirm whether your PBX can supply a usable feed before you commit, and scope any adapter needed for a legacy system. Adapters for older PBXs may add some lead time. Because Clarity combines data sources in one tenant, a business running a legacy PBX at some sites and Teams or FirstNet Hosted PBX at others gets one view and one chargeback model across all of them, which keeps reporting consistent while an older PBX is being replaced. URL: https://www.firstnet.co.za/knowledge/voice/will-this-work-with-our-existing-pbx/. Reviewed 2026-10-10. #### Will FirstNet SIP trunks work with my existing PBX? Yes, if your PBX is SIP-compliant. FirstNet SIP Trunks work out of the box with most modern IP-PBXs, including Yeastar, Cisco, Avaya IP Office, Mitel, FreePBX, 3CX, Asterisk and Panasonic, as well as cloud-hosted PBXs. Older digital systems can connect through a media gateway. What FirstNet checks before go-live: - PBX make, model, firmware and SIP version. - Codec support, with G.711 as the baseline and G.729 or Opus where required. - Registration mode versus trunk mode. - TLS and SRTP support for encrypted signalling and media. - Firewall and NAT set-up, and whether a session border controller is needed. Older TDM systems using PRI, BRI or analogue lines need a media gateway in front to convert calls to SIP. That adds some complexity but does not rule the PBX out. Where a PBX is genuinely past end of life, FirstNet Managed Cloud PBX is a clean migration path, and the same trunk stays underneath, so the PBX can change later without disturbing it. Your PBX also needs to present valid caller ID (CLI) in the correct format, because invalid CLI can be blocked upstream or charged at higher rates. URL: https://www.firstnet.co.za/knowledge/voice/will-sip-trunks-work-with-my-existing-pbx/. Reviewed 2026-10-10. #### Will VoIP call quality be good over the internet on FirstNet SIP trunks? Yes, on a suitable access circuit. When you also take FirstNet connectivity, FirstNet engineers quality of service (QoS) end to end so voice is prioritised. Best-effort internet works, but call quality over it cannot be guaranteed in MOS (Mean Opinion Score) terms. What determines call quality: - An uncontended link, ideally dedicated fibre, with about 100 Kbps per concurrent call plus 20% headroom. - One-way latency under 150 ms, jitter under 30 ms and packet loss under 1%. - Voice marked and prioritised (DSCP EF) from your LAN through to the provider. - Firewall settings, with SIP ALG disabled and RTP ports open. - Codecs, with G.711 as the baseline and G.729 or Opus where required. FirstNet's own voice core runs on dual PortaOne clusters with zero-downtime updates, and calls reach other operators over direct interconnects. FirstNet's SLA covers what it manages: trunk availability, signalling, termination over its network and support. For links FirstNet does not manage, it recommends the right access for your call profile and can run a 24-hour line monitor that measures jitter, latency and loss before you commit. URL: https://www.firstnet.co.za/knowledge/voice/will-voice-quality-be-good-over-the-internet/. Reviewed 2026-10-11. #### Will callers get stuck talking to a bot with FirstNet AI Receptionist? No. FirstNet AI Receptionist uses natural language rather than keypad menus, and hands complex or sensitive calls to a human agent in the Linkus app. The agent sees the call transcript and AI summary, so callers do not have to repeat themselves. How escalation works: - The AI Receptionist works out what the caller wants from what they say, then routes the call to the right menu, queue or extension. - Intents that are complex or sensitive are escalated to a person automatically. - Escalation rules are agreed during design and confirmed with sample calls before go-live. - It can also capture a callback or trigger a voicemail-to-email flow instead of transferring. - Every call produces a transcript and AI summary attached to the call record. Callers tend to dislike badly designed IVR trees and bot loops with no way out. The AI Receptionist is built the other way round: it is trained on your own documents, website pages and FAQs, and designed to hand over to a human as soon as a request becomes complex. FirstNet does not promise 100% intent recognition, which is why a human escalation path is part of every set-up rather than an optional extra. URL: https://www.firstnet.co.za/knowledge/voice/will-callers-get-stuck-talking-to-a-bot/. Reviewed 2026-10-10. ### Sovereign AI #### Can FirstNet's EngineAI build AI agents that automate multi-step business workflows? Yes. EngineAI, the build team of FirstCoreAI, FirstNet's AI business unit, builds autonomous agents: multi-step workflows that approve, route, tag and report without a person at every step. EngineAI takes each use case from proof of concept to production. Unlike a chatbot that only answers questions, an AI agent carries out a sequence of actions, such as classifying an item, deciding where it should go and updating the right system. What shapes an EngineAI agent build: - Integration: connections into Microsoft 365, your CRM and other line-of-business systems, where the work actually happens - Structured data: EngineAI's document and call pipelines turn large volumes of files and recordings into structured output, such as JSON, for downstream systems - Deployment: on the AI Factory in FirstNet's South African data centre, or inside your own environment - Models: open-weight by default, with frontier APIs only where justified, and notice from FirstCoreAI whenever a request would leave the country When an agent's inference runs on the AI Factory, the prompts and data it processes stay in South Africa. That matters for workflows involving customer records, claims or call recordings, where an offshore AI API would mean a cross-border transfer with POPIA questions attached. FirstCoreAI scopes the business problem first and will say plainly if AI is not the right tool. URL: https://www.firstnet.co.za/knowledge/sovereign-ai/can-engineai-build-ai-agents-that-automate-multi-step-business-workflows/. Reviewed 2026-10-11. #### Can FirstNet's EngineAI build a RAG system that answers questions from our own documents? Yes. RAG and retrieval is a core capability of EngineAI, the build team of FirstCoreAI, FirstNet's AI business unit. EngineAI makes documents, contracts and internal knowledge searchable and answerable in plain language, and takes the system from proof of concept to production. Retrieval-augmented generation (RAG) finds the passages in your own content that are relevant to a question and passes them to a language model, so answers draw on your material rather than only on what the model learned in training. How EngineAI approaches it: - InfraAI, the AI Factory service, suits RAG and retrieval back-ends, with multilingual embeddings and a retrieval reranker available through OpenAI-compatible endpoints - Most EngineAI projects run on InfraAI compute in FirstNet's South African data centre, so documents, models and pipelines stay in the country, or the system can be deployed in your own environment - Open-weight models are the default, with frontier APIs only where justified - Integration connects the solution to Microsoft 365, your CRM and other line-of-business systems FirstCoreAI benchmarks every model on the AI Factory against frontier APIs for accuracy, latency, concurrency and cost per unit of work, so you see the evidence before committing. FirstCoreAI is already in production in financial services and insurance, where claims and document extraction are typical workloads. A FirstCoreAI scoping call is the place to begin. URL: https://www.firstnet.co.za/knowledge/sovereign-ai/can-engineai-build-a-rag-system-that-answers-questions-from-our-own-documents/. Reviewed 2026-10-11. #### Can FirstNet's EngineAI team fine-tune an AI model to our industry terminology? Yes. EngineAI, the build team of FirstNet's AI business unit FirstCoreAI, offers fine-tuning and model optimisation that adapt models to your domain, your terminology and your own data. Fine-tuning helps when general-purpose models handle sector jargon, product names or internal abbreviations poorly. EngineAI can combine it with its other capabilities: - RAG and retrieval, so answers draw on your documents, contracts and internal knowledge. - Document and call pipelines for intake, extraction, transcription and structured output. - Integration into Microsoft 365, your CRM and other line-of-business systems. Most EngineAI projects run on InfraAI compute in FirstNet's South African data centre, so models, data and pipelines stay in the country. Open-weight models are the default, and because their weights are available they can be adapted and hosted locally rather than through a foreign platform. FirstCoreAI scopes each problem first and will say plainly if AI is not the right tool. A scoping call or demo with FirstCoreAI is the place to start. URL: https://www.firstnet.co.za/knowledge/sovereign-ai/can-a-model-be-tuned-to-our-industry-terminology/. Reviewed 2026-10-10. #### Can FirstNet's FirstCoreAI AI adoption service be combined with EngineAI custom AI work? Yes. Many FirstCoreAI clients combine AI Adoption & Enablement with EngineAI builds, such as integrations into Microsoft 365 and line-of-business systems. Both are services of FirstCoreAI, FirstNet's AI business unit, so the people side and the build side can be planned together. Adoption covers private AI assistants, role-based training, AI governance and change leadership. EngineAI is FirstCoreAI's build team, taking a use case from proof of concept to production. Its work includes: - RAG and retrieval that make documents, contracts and internal knowledge searchable in plain language. - Document and call pipelines for intake, extraction, transcription and structured output. - Autonomous agents for multi-step workflows that approve, route, tag and report. - Fine-tuning that adapts models to your domain, terminology and data. - Integration into Microsoft 365, your CRM and other line-of-business systems. EngineAI solutions are deployed on the AI Factory in FirstNet's South African data centre or inside your own environment. FirstCoreAI's four solution lines each work on their own, but most organisations combine two or three. A scoping call with FirstCoreAI can cover both the adoption programme and the custom build. URL: https://www.firstnet.co.za/knowledge/sovereign-ai/can-enterpriseai-be-combined-with-custom-ai-work/. Reviewed 2026-10-10. #### Can FirstNet's FirstCoreAI process call recordings with AI without sending them offshore? Yes. FirstCoreAI processes call recordings on the AI Factory in FirstNet's South African data centre, so they stay in the country. The pipeline covered every stage from audio to usable data: - Transcription and correction of every recording. - Name resolution across calls. - Structured JSON output for downstream systems. - Processing entirely on local infrastructure. Keeping call recordings local matters because sending them to an offshore AI API is a cross-border transfer, with POPIA consent and breach questions attached. The FirstCoreAI AI Factory in FirstNet's South African data centre includes a speech-to-text model exposed through an OpenAI-compatible audio transcriptions endpoint. Document and call pipelines are a core EngineAI capability, covering intake, extraction, transcription and structured output for large volumes of files and recordings. FirstCoreAI names call archives as a typical use case in financial services and insurance, and as a good single workload to start with. FirstCoreAI can scope your own archive on a 30-minute scoping call. URL: https://www.firstnet.co.za/knowledge/sovereign-ai/can-you-process-call-recordings-without-sending-them-offshore/. Reviewed 2026-10-10. #### Can FirstNet's FirstCoreAI train our teams to use AI? Yes. FirstCoreAI, FirstNet's AI business unit, provides practical, role-based training, so people learn to use AI on their own work, safely and consistently. It is part of the AI Adoption & Enablement service and aims to make teams productive with AI, not merely licensed. How the training fits in: - It is role-based and built around real, day-to-day tasks. - It sits alongside AI governance, where usage policies, data-handling rules and guardrails tell staff what is safe to share. - In FirstCoreAI's adoption path, training is in place before wider rollout, after a pilot group has used AI on real work with clear success measures. - As AI scales across teams, usage and outcomes keep being measured. When the assistants people train on run on the Sovereign AI Factory in FirstNet's South African data centre, the prompts and documents they use stay in the country. Training can be combined with executive and management briefings, or with EngineAI integrations into Microsoft 365 and line-of-business systems. A 30-minute scoping call with FirstCoreAI identifies the first use cases and plans a pilot. URL: https://www.firstnet.co.za/knowledge/sovereign-ai/can-you-train-our-teams/. Reviewed 2026-10-10. #### Can I get dedicated GPU capacity in South Africa from FirstNet's InfraAI service? Yes. InfraAI, the GPU and inference service from FirstNet's AI business unit FirstCoreAI, offers both dedicated and shared GPU capacity on the AI Factory, sized to the workload and billed in rand. The AI Factory runs current-generation NVIDIA Blackwell-class GPUs with AMD EPYC processors and more than a terabyte of system RAM per node, in FirstNet's South African data centre. Run.ai handles GPU-aware scheduling and vLLM serves inference. What InfraAI capacity includes: - Dedicated or shared GPU options, sized to your workload. - Dedicated capacity instead of a shared public queue. - Private inference endpoints hosted locally, with every inference inside the South African perimeter. - Support from the engineers who run the Factory. - Rand-denominated, forecastable commercials with no FX surprises. InfraAI suits high-volume document and call processing, RAG and retrieval back-ends, internal assistants, classification and extraction. On the production cluster, FirstCoreAI measured 271 concurrent requests sustained at peak with zero errors across its stress tests. To size capacity for your workload, book a demo or scoping call with FirstCoreAI. URL: https://www.firstnet.co.za/knowledge/sovereign-ai/can-i-get-dedicated-gpu-capacity/. Reviewed 2026-10-10. #### Can I still use overseas frontier AI models with FirstNet's FirstCoreAI sovereign AI platform? Yes. Sovereign does not mean isolated: FirstCoreAI, FirstNet's AI business unit, runs open-weight models in South Africa by default, and frontier APIs from overseas labs can be used where a workload justifies it. FirstCoreAI tells you plainly when a request would leave the country. Most workloads run well on the open-weight models hosted on the AI Factory in FirstNet's South African data centre. The live catalogue includes an 80B mixture-of-experts coding model, a 31B general chat model, vision-language, speech-to-text, multilingual embeddings and a retrieval reranker. How the choice is made: - Every model on the AI Factory is benchmarked on the same hardware against frontier APIs for accuracy, latency, concurrency and cost per unit of work, so you see the evidence before committing. - Frontier routing is optional, and you get notice when a request goes offshore. - The decision is made per workload, so sensitive data such as customer records or call recordings can stay on local models while frontier APIs are reserved for workloads that justify them. This lets you keep sensitive processing inside South Africa, with rand-denominated costs, without giving up access to frontier models where they genuinely add value. URL: https://www.firstnet.co.za/knowledge/sovereign-ai/can-i-still-use-frontier-models-like-those-from-overseas-labs/. Reviewed 2026-10-10. #### Can I tour FirstNet's FirstCoreAI AI Factory GPU cluster? Yes. FirstCoreAI, FirstNet's AI business unit, runs AI Factory tours of 60 to 90 minutes that cover the hardware, the model catalogue and a live workload. Tours are booked directly with FirstCoreAI. A tour is one of two ways to start an engagement, alongside a 30-minute scoping call. It shows: - The hardware: the NVIDIA Blackwell-class GPU cluster that FirstCoreAI owns and operates in FirstNet's South African data centre. - The model catalogue: six live endpoints covering coding, chat, vision-language, speech-to-text, multilingual embeddings and reranking. - A live workload running on the cluster through OpenAI-compatible APIs. FirstCoreAI stress-tested the production cluster under real serving conditions, measuring a median time to first token of about 0.6 seconds on chat and coding models and 271 concurrent requests sustained at peak with zero errors. To get the most from a tour, bring one workload you want to see running sovereign, such as a document pipeline, call archive, chatbot or a model you cannot deploy today. URL: https://www.firstnet.co.za/knowledge/sovereign-ai/can-i-tour-the-ai-factory/. Reviewed 2026-10-10. #### Can approval workflows be built into FirstNet's StudioAI content production process? Yes. StudioAI, the creative and content AI service from FirstNet's AI business unit FirstCoreAI, automates campaign workflows and approval flows, so content moves through review and publishing in one connected system. StudioAI connects the stages of content production so scripting, production, approvals and publishing run through one system, plugged into the creative tools your team already uses. How approvals fit in: - Campaign workflows are automated, so content moves from draft to publish faster. - Approval flows sit in the same connected system as production and publishing. - On-brand templates and asset libraries keep output aligned to your guidelines. - Your existing creative tools stay in place; StudioAI connects them rather than replacing them. This matters when personalised video, voiceover, copy and design are produced at a volume manual production cannot match. FirstCoreAI can walk you through a complete campaign, from script to publish, in a single demo session. URL: https://www.firstnet.co.za/knowledge/sovereign-ai/can-approvals-be-built-into-the-process/. Reviewed 2026-10-10. #### Can we see a demo of FirstNet's StudioAI creative content service? Yes. FirstCoreAI, FirstNet's AI business unit, demonstrates a complete, worked StudioAI campaign from script to publish in a single session. Demos are booked directly with FirstCoreAI. A StudioAI campaign runs through connected steps in one system: - Scripting and production of personalised video, voiceover, copy and design. - On-brand output through templates and asset libraries. - Automated campaign workflows and approval flows. - Publishing through the same connected workflow. A demo is a useful way to see how StudioAI would plug into the creative tools your team already uses, since it integrates with them rather than replacing them. Many organisations look at StudioAI after infrastructure or engineering conversations with FirstCoreAI, because content often delivers a quick, visible result. To arrange one, book a demo with FirstCoreAI, or talk to FirstNet on 0861 989 896 or sales@firstnet.co.za. URL: https://www.firstnet.co.za/knowledge/sovereign-ai/can-we-see-a-demo/. Reviewed 2026-10-10. #### Do I need to rewrite my application to use FirstNet's InfraAI GPU and inference service? No. Every model on InfraAI, the GPU and inference service from FirstNet's AI business unit FirstCoreAI, is exposed through an OpenAI-compatible API, so any SDK that already works with OpenAI works with InfraAI. You only swap in the endpoint URLs and credentials issued at onboarding. InfraAI runs on the AI Factory in FirstNet's South African data centre. Applications call standard endpoints: - /v1/chat/completions for chat and coding - /v1/embeddings for search and retrieval - /v1/audio/transcriptions for speech-to-text - /v1/rerank for retrieval reranking Your application authenticates with OAuth2 client credentials and receives a short-lived bearer token. TLS terminates at the cluster edge and each request is validated. Your token endpoint and URLs are issued at onboarding, and existing OpenAI SDKs work without code changes. For an application already built on an OpenAI SDK, moving to InfraAI is a configuration change rather than a rebuild. The difference is where it runs: inference then happens in South Africa, on dedicated or shared GPU capacity sized to the workload, with rand-denominated billing. URL: https://www.firstnet.co.za/knowledge/sovereign-ai/do-i-need-to-rewrite-my-application-to-use-infraai/. Reviewed 2026-10-10. #### Do our prompts and documents leave South Africa when we use FirstNet's FirstCoreAI assistants? No. FirstCoreAI's private AI assistants run on the Sovereign AI Factory, and inference runs on GPUs in FirstNet's South African data centre, operated by FirstCoreAI. Your prompts, documents and outputs are processed and stay in the country. The assistants are secure chat and document tools that work with your own knowledge, with nothing sent offshore. By contrast, sending customer records or call recordings to an offshore AI API is a cross-border transfer, with POPIA consent and breach questions attached. Details worth knowing: - FirstCoreAI owns and operates the GPU cluster, and it runs on networks FirstNet operates. - Models are open-weight and hosted locally, so you are not locked into a foreign platform. - Access uses OAuth2 client credentials and short-lived bearer tokens, and each request is validated. - Frontier models from overseas labs are optional. If a workload is routed to one, FirstCoreAI tells you plainly that the request would leave the country. This is what makes the approach POPIA-aligned by design, and it removes foreign-jurisdiction and data-export concerns before rollout starts. URL: https://www.firstnet.co.za/knowledge/sovereign-ai/do-our-prompts-and-documents-leave-south-africa/. Reviewed 2026-10-10. #### Do we have to replace our current creative tools to use FirstNet's StudioAI? No. StudioAI, the creative and content AI service from FirstNet's AI business unit FirstCoreAI, integrates with the creative tools your team already uses and connects them into one workflow, rather than asking you to rebuild your marketing stack. StudioAI plugs proven creative tools into your existing stack and connects the steps between them, so scripting, production, approvals and publishing run through one system. What that means in practice: - Your existing creative stack stays in place, and StudioAI integrates into it. - Approvals and publishing flow through one system. - On-brand templates and asset libraries keep output aligned to your guidelines. - Personalised video, voiceover, copy and design can be produced at a volume manual production cannot match. Because nothing has to be replaced, StudioAI often delivers a quick, visible win, and many clients add it after starting with FirstCoreAI's infrastructure or engineering services. A FirstCoreAI demo walks through a complete campaign from script to publish in a single session. URL: https://www.firstnet.co.za/knowledge/sovereign-ai/do-we-have-to-replace-our-current-creative-tools/. Reviewed 2026-10-10. #### Does FirstNet's FirstCoreAI help with AI policy and governance? Yes. As part of its AI Adoption & Enablement service, FirstCoreAI, FirstNet's AI business unit, helps you define AI usage policies, data-handling rules and guardrails aligned to POPIA, so people know what is safe to share and AI use stays compliant. Most AI projects stall between the pilot and everyday use: people are unsure what they may share, data ends up in foreign services and nobody owns the outcome. Governance answers those questions before AI use spreads. What the governance work covers: - Usage policies that set out how AI may be used in your organisation. - Clear data-handling rules on what data may be used where. - Guardrails that help keep everyday use within policy. - Timing: in FirstCoreAI's adoption path, policies, guardrails and training are in place before wider rollout, after a controlled pilot. It also helps that the assistants themselves run on the Sovereign AI Factory in FirstNet's South African data centre: prompts and documents are processed in the country rather than sent to foreign services, which removes the biggest data risk first. FirstCoreAI can scope governance work alongside a pilot on a 30-minute scoping call. URL: https://www.firstnet.co.za/knowledge/sovereign-ai/do-you-help-with-ai-policy-and-governance/. Reviewed 2026-10-10. #### Does sovereign AI from FirstNet's FirstCoreAI help with POPIA compliance? Yes, it helps. FirstCoreAI, FirstNet's AI business unit, designs its endpoints, retention and access controls to align with POPIA obligations, and because inference runs in FirstNet's South African data centre, workloads that stay on the AI Factory involve no cross-border transfer to reconcile. Sending customer records, claims or call recordings to an offshore AI API is a cross-border transfer, with consent and breach questions attached. Data held by foreign providers can also fall under foreign law, such as the US CLOUD Act. Local, sovereign hosting means only the people you have authorised can reach your information. How FirstCoreAI supports a POPIA-aligned approach: - Prompts, documents and outputs are processed in South Africa on infrastructure FirstCoreAI owns and operates. - Access uses OAuth2 client credentials and short-lived bearer tokens, and each request is validated. - AI governance work sets usage policies, data-handling rules and guardrails aligned to POPIA, so staff know what is safe to share. - If a workload is routed to an overseas frontier model, FirstCoreAI tells you plainly that the request would leave the country. Local hosting supports compliance but does not replace your organisation's own POPIA obligations. A FirstCoreAI scoping call can identify which workloads should stay on the AI Factory. URL: https://www.firstnet.co.za/knowledge/sovereign-ai/does-sovereign-ai-help-with-popia-compliance/. Reviewed 2026-10-10. #### How do we get started with sovereign AI from FirstNet's FirstCoreAI? Start with one workload. Bring FirstCoreAI, FirstNet's AI business unit, a single use case, such as a document pipeline, call archive, chatbot or a model you cannot deploy, and book a 30-minute scoping call or an AI Factory tour. FirstCoreAI will show it running sovereign. A typical path looks like this: - Scoping: a 30-minute call that starts with the business problem, not the technology, and defines what a working solution looks like. FirstCoreAI will say plainly if AI is not the answer. - See it running: a demo, or a 60 to 90 minute AI Factory tour covering the hardware, the model catalogue and a live workload. - Pilot: a defined group uses the solution on real work, with clear success measures. - Scale: roll out once policies, guardrails and training are in place, and keep measuring usage and outcomes. Good first workloads are ones where data is sensitive and volumes are high, for example claims, call archives and document extraction in financial services and insurance, or personalisation and campaign automation in retail and FMCG. Demos, scoping calls and tours are booked directly with FirstCoreAI. You can also talk to FirstNet on 0861 989 896 or sales@firstnet.co.za. URL: https://www.firstnet.co.za/knowledge/sovereign-ai/how-do-we-get-started/. Reviewed 2026-10-10. #### How does FirstCoreAI, the AI business unit, relate to FirstNet and the First Technology Group? FirstCoreAI is a business unit of FirstNet, the data-centre, connectivity and ISP arm of the First Technology Group. It is FirstNet's AI business, and its AI Factory GPU cluster runs inside FirstNet's South African data centre on networks FirstNet operates. That structure means the team that runs your connectivity also runs the platform your AI lives on. FirstCoreAI owns and operates the physical compute, and network tuning, rack scaling and cross-connects are handled by one team. FirstNet was founded in 2006 as a wholly owned subsidiary of the First Technology Group, which has over three decades in South African IT. FirstCoreAI delivers four solution lines from that platform: - GPU & Inference (InfraAI): private inference endpoints and GPU capacity, hosted locally and billed in rand. - Custom AI Engineering (EngineAI): RAG systems, AI agents, document and call pipelines, and fine-tuned models. - Creative & Content AI (StudioAI): personalised video, voice, copy and design produced at scale. - AI Adoption & Enablement: private AI assistants, training and governance. Each line works on its own, but most organisations combine two or three. Demos, scoping calls and AI Factory tours are booked directly with FirstCoreAI. URL: https://www.firstnet.co.za/knowledge/sovereign-ai/how-does-firstcoreai-relate-to-firstnet/. Reviewed 2026-10-10. #### How does FirstNet's FirstCoreAI get leadership on board with AI adoption? FirstCoreAI, FirstNet's AI business unit, runs executive and management briefings as part of its AI Adoption & Enablement service. The briefings start from wherever the scepticism sits and turn it into genuine sponsorship, so leaders actively back AI use. Leadership matters because most AI projects stall between the pilot and everyday use, often because nobody owns the outcome. FirstCoreAI builds executive sponsorship from the start, as part of a structured change programme, rather than leaving uptake to chance. The rest of the adoption path then gives leaders evidence to back: - Discover: identify the use cases and data that will deliver value first. - Pilot: a defined group uses a sovereign assistant on real work, with clear success measures. - Govern: policies, guardrails and training are in place before wider rollout. - Scale: roll out across teams and keep measuring usage and outcomes. Running assistants on the Sovereign AI Factory also answers a common executive concern about data. Prompts, documents and outputs are processed in South Africa on infrastructure FirstCoreAI owns and operates, which removes foreign-jurisdiction and data-export concerns before you start. URL: https://www.firstnet.co.za/knowledge/sovereign-ai/how-do-you-get-leadership-on-board/. Reviewed 2026-10-10. #### How does StudioAI relate to FirstNet's other FirstCoreAI sovereign AI services? StudioAI is one application of the wider FirstCoreAI platform, the AI business unit of FirstNet. Many clients start with infrastructure (InfraAI) or engineering (EngineAI) and add StudioAI as a quick, visible win. FirstCoreAI offers four solution lines. Each works on its own, but most organisations combine two or three: - GPU & Inference (InfraAI): private inference endpoints and GPU capacity from the AI Factory, hosted locally and billed in rand. - Custom AI Engineering (EngineAI): RAG systems, AI agents, document and call pipelines, and fine-tuned models. - Creative & Content AI (StudioAI): personalised video, voice, copy and design at scale, kept on-brand. - AI Adoption & Enablement: private AI assistants, training and governance. Most clients reach StudioAI after infrastructure and engineering conversations. Content is seldom the first sovereignty concern, but it often delivers a quick, visible result. All four lines are delivered from South Africa, and a FirstCoreAI scoping call can map which combination fits your organisation. URL: https://www.firstnet.co.za/knowledge/sovereign-ai/how-does-studioai-relate-to-the-other-firstcoreai-services/. Reviewed 2026-10-10. #### How is FirstNet's FirstCoreAI sovereign AI service billed? FirstCoreAI, FirstNet's AI business unit, bills sovereign AI in South African rand on a workload-based model, so costs are predictable and not exposed to exchange-rate movements. Pricing is discussed during scoping with FirstCoreAI. Offshore AI services are typically metered per token in dollars, so the bill moves with both usage and the exchange rate. Running open-weight models on local hardware in FirstNet's South African data centre turns that into predictable, rand-denominated spend that finance teams can actually forecast. Because commercials are workload-based, the starting point is the workload itself: a document pipeline, call archive, chatbot, internal assistant or a model you want to host. On InfraAI, FirstCoreAI's GPU and inference service, you can choose dedicated or shared GPU capacity, sized to that workload and billed in rand. Every model on the AI Factory is also benchmarked against frontier APIs for cost per unit of work, alongside accuracy, latency and concurrency, so you can compare the economics with evidence before committing. To get a rand figure for your own workload, book a scoping call with FirstCoreAI, or talk to FirstNet on 0861 989 896. URL: https://www.firstnet.co.za/knowledge/sovereign-ai/how-is-sovereign-ai-billed/. Reviewed 2026-10-10. #### How is access to FirstNet's InfraAI inference endpoints on the FirstCoreAI AI Factory secured? Clients authenticate to InfraAI with OAuth2 client credentials and receive short-lived bearer tokens. TLS is terminated at the edge of FirstCoreAI's AI Factory cluster in FirstNet's South African data centre, and OAuth2 proxies validate each request. How the security layers fit together: - Authentication: the OAuth2 client credentials flow is designed for application-to-application access, and short-lived tokens limit how long a leaked token stays useful. - Encryption in transit: TLS terminates at the cluster edge, where HAProxy and a Knative gateway handle incoming traffic. - Request validation: OAuth2 proxies check every request before it is served. - Management isolation: out-of-band management is segregated from the in-band fabric between nodes. - Onboarding: your token endpoint, endpoint URLs and credentials are issued to you at onboarding. Data protection goes beyond access control. Inference runs on GPUs that FirstCoreAI, FirstNet's AI business unit, owns and operates in South Africa, and FirstCoreAI designs its endpoints, retention and access controls to align with POPIA. Requests stay in the country unless a workload uses optional frontier routing, in which case FirstCoreAI gives notice. URL: https://www.firstnet.co.za/knowledge/sovereign-ai/how-is-access-secured/. Reviewed 2026-10-10. #### What can FirstNet's StudioAI creative and content AI service produce? StudioAI produces hyper-personalised video, voiceover, copy and design at scale, kept on-brand through templates and asset libraries. It is the creative and content AI offering from FirstCoreAI, FirstNet's AI business unit, for organisations where content itself is the workload. What it covers: - Personalised content: video, voice and copy tailored to audiences at a volume manual production cannot match. - Brand consistency: on-brand templates and asset libraries keep every output aligned to your guidelines. - Workflow automation: campaign workflows and approval flows are automated, so content moves from draft to publish faster. - Tool integration: StudioAI works with the creative tools your team already uses rather than replacing them. StudioAI connects scripting, production, approvals and publishing into one system, plugged into your existing creative stack. It fits retail and FMCG teams working on personalisation and campaign automation, and it often delivers a quick, visible result for organisations already working with FirstCoreAI on infrastructure or engineering. FirstCoreAI can walk you through a complete campaign, from script to publish, in a single demo session. URL: https://www.firstnet.co.za/knowledge/sovereign-ai/what-can-studioai-produce/. Reviewed 2026-10-10. #### What does FirstNet's FirstCoreAI AI Adoption & Enablement service cover? FirstCoreAI's AI Adoption & Enablement service covers four things: private AI assistant rollout, role-based training, AI governance (usage policies, data-handling rules and guardrails) and change leadership for executives and managers. FirstCoreAI is FirstNet's AI business unit, and the aim is that people use AI well, safely and consistently. What each part includes: - Private AI assistants: secure chat and document assistants that run on the Sovereign AI Factory and work with your own knowledge, with nothing sent offshore. - Training and enablement: practical, role-based training that makes teams productive with AI, not merely licensed. - AI governance: usage policies, data-handling rules and guardrails aligned to POPIA, so people know what is safe to share. - Change leadership: executive and management briefings that turn scepticism into genuine sponsorship. Every engagement follows a measured path. Discover the use cases and data that deliver value first, pilot with a defined group and clear success measures, put policies, guardrails and training in place before wider rollout, then scale across teams while measuring usage and outcomes. The service suits organisations that already have AI tools but are not yet seeing the value, and those that want to get adoption right the first time. URL: https://www.firstnet.co.za/knowledge/sovereign-ai/what-does-enterpriseai-cover/. Reviewed 2026-10-10. #### What happens if FirstNet's FirstCoreAI finds AI isn't the right fit for our problem? FirstCoreAI, FirstNet's AI business unit, scopes each problem first and will tell you honestly if AI is not the right tool. You start with the business problem, not the technology, and the scoping shows what a working solution would look like. How scoping works: - It starts with a 30-minute scoping call or a demo, booked directly with FirstCoreAI. - The focus is the business problem and the data involved, not a particular model or product. - FirstCoreAI says so plainly if AI is not the answer. - Where AI does fit, open-weight models are the default, with frontier APIs only where justified. When AI is a fit, FirstCoreAI's EngineAI team takes the use case from proof of concept to production, building RAG systems, document and call pipelines, AI agents, fine-tuned models or integrations. Solutions run on the AI Factory in FirstNet's South African data centre or in your own environment. Adoption work follows the same principle: every engagement starts small, with a pilot and clear success measures, and earns its way to scale. URL: https://www.firstnet.co.za/knowledge/sovereign-ai/what-if-ai-isnt-the-right-fit-for-our-problem/. Reviewed 2026-10-10. #### What is sovereign AI, and how does FirstNet's FirstCoreAI deliver it in South Africa? Sovereign AI is AI that runs on infrastructure in your own country, under your own laws and priced in your own currency. FirstNet delivers it through FirstCoreAI, its AI business unit, which runs inference on GPUs in FirstNet's South African data centre so your data stays in the country. For South African organisations, sovereign AI addresses three pressures that offshore AI services leave open: - Data residency: sending customer records, claims or call recordings to an offshore API is a cross-border transfer, with POPIA consent and breach questions attached. - Jurisdiction: data held by foreign providers can fall under foreign law, such as the US CLOUD Act. - Cost: offshore AI is typically metered per token in dollars, while FirstCoreAI bills in rand. The FirstCoreAI AI Factory is a Blackwell-class GPU cluster that FirstCoreAI owns and operates, serving open-weight models through OpenAI-compatible APIs. Sovereign does not mean isolated: frontier APIs can still be used where a workload justifies it, and FirstCoreAI tells you plainly when a request would leave the country. Sovereign AI matters most where data is sensitive and volumes are high, such as financial services and insurance, retail and FMCG, and public-sector workloads where residency is a legal requirement. URL: https://www.firstnet.co.za/knowledge/sovereign-ai/what-is-sovereign-ai/. Reviewed 2026-10-10. #### What kind of custom AI solutions does FirstNet's EngineAI team build? FirstNet's EngineAI team builds RAG search, document and call pipelines, AI agents, fine-tuned models and links into Microsoft 365, CRMs and line-of-business systems. It takes each use case from proof of concept to live production. EngineAI is the build team of FirstCoreAI, FirstNet's AI business unit. What it builds: - RAG and search: RAG (retrieval-augmented generation) makes documents, contracts and in-house knowledge searchable, with answers in plain language. - Document and call pipelines: intake, extraction, transcription and structured output for large volumes of files and recordings. - Autonomous agents: multi-step workflows that approve, route, tag and report without a person at every step. - Fine-tuning and optimisation: models adapted to your field, your terms and your own data. - Integration: hooks into Microsoft 365, your CRM and other line-of-business systems. Most EngineAI projects run on InfraAI compute in FirstNet's South African data centre. That way, models, data and pipelines stay in the country. Or EngineAI can set up the solution on your own systems instead. Open-weight models are the default, with frontier APIs used where the case justifies them. Not one recording left South Africa. URL: https://www.firstnet.co.za/knowledge/sovereign-ai/what-kind-of-ai-solutions-does-engineai-build/. Reviewed 2026-10-10. #### Where are FirstNet's EngineAI custom AI solutions deployed? EngineAI solutions are deployed either on the FirstCoreAI AI Factory in FirstNet's South African data centre or into your own environment, depending on what suits the workload. EngineAI is the build team of FirstCoreAI, FirstNet's AI business unit. Most EngineAI projects run on InfraAI compute on the AI Factory, so models, data and pipelines stay in the country. Where it makes more sense, solutions can be deployed into your own environment instead. Deployment principles: - Build on the AI Factory or in your environment. - Open-weight models by default, with frontier APIs only where a workload justifies them. - Notice from FirstCoreAI whenever a request would leave South Africa. - On the AI Factory, OpenAI-compatible APIs with OAuth2 client credentials and short-lived bearer tokens. Running on the AI Factory keeps every inference inside the South African perimeter, on infrastructure FirstCoreAI owns and operates, with rand-denominated billing. That suits workloads where data sensitivity or cost rules out a foreign API. A scoping call with FirstCoreAI is the place to work out which option suits your workload. URL: https://www.firstnet.co.za/knowledge/sovereign-ai/where-are-the-solutions-deployed/. Reviewed 2026-10-10. #### Where is FirstNet's FirstCoreAI AI Factory hosted, and does inference stay in South Africa? The FirstCoreAI AI Factory is hosted in FirstNet's data centre in South Africa. FirstCoreAI, FirstNet's AI business unit, owns and operates the GPU cluster, and inference on the AI Factory happens inside South Africa. The AI Factory is physical compute, tuned for production throughput and concurrency rather than benchmark leaderboards, and it runs on networks FirstNet operates. Network tuning, rack scaling and cross-connects are handled by one team. What is inside: - Current-generation NVIDIA Blackwell-class GPUs with AMD EPYC processors and more than a terabyte of system RAM per node. - A multi-terabyte NVMe model cache shared over NFS, a high-throughput in-band fabric between nodes and segregated out-of-band management. - Kubernetes with Run.ai for GPU-aware scheduling, vLLM for inference, HAProxy and a Knative gateway at the edge, and Grafana and Prometheus for monitoring. - Six live production model endpoints exposed through an OpenAI-compatible API. Because processing stays local, workloads on the AI Factory involve no cross-border transfer of data. FirstCoreAI runs 60 to 90 minute tours covering the hardware, the model catalogue and a live workload, booked directly with FirstCoreAI. URL: https://www.firstnet.co.za/knowledge/sovereign-ai/where-is-the-ai-factory-hosted/. Reviewed 2026-10-10. #### Which AI models are available on FirstNet's InfraAI service and FirstCoreAI AI Factory? Six production model endpoints are live on the FirstCoreAI AI Factory, which InfraAI delivers as a service: an 80B mixture-of-experts coding model, a 31B general chat model, vision-language, speech-to-text, multilingual embeddings and a retrieval reranker. All are open-weight models hosted in FirstNet's South African data centre. The catalogue at a glance: - Coding: an 80B mixture-of-experts model with a 131K context window. - General chat: a 31B model with a 128K context window. - Vision-language: for tasks that combine images and text. - Speech-to-text: transcription through the audio transcriptions endpoint. - Multilingual embeddings and a retrieval reranker: the building blocks for search and RAG. Every model is exposed through an OpenAI-compatible API and is benchmarked on the same hardware against frontier APIs for accuracy, latency, concurrency and cost per unit of work. On the production cluster, FirstCoreAI measured a median time to first token of about 0.6 seconds on the chat and coding models. Where a workload genuinely needs an overseas frontier model, requests can be routed to a frontier API, and FirstCoreAI gives notice when a request leaves the country. URL: https://www.firstnet.co.za/knowledge/sovereign-ai/which-models-are-available/. Reviewed 2026-10-10. #### Which organisations is FirstNet's StudioAI creative and content AI service best suited to? StudioAI suits organisations where content itself is the workload: teams that need personalised video, voiceover, copy and design at a volume manual production cannot match, while keeping every output on-brand. It is the creative and content AI service of FirstCoreAI, FirstNet's AI business unit. It is a strong fit where one or more of these apply: - Retail and FMCG teams working on personalisation and campaign automation - Marketing teams that want scripting, production, approvals and publishing to run through one connected system - Brands whose guidelines must hold across high volumes, supported by on-brand templates and asset libraries - Teams that want to keep their existing creative tools rather than rebuild the marketing stack - Organisations already working with FirstCoreAI on GPU infrastructure (InfraAI) or custom engineering (EngineAI) Most clients reach StudioAI after infrastructure and engineering conversations. Content is seldom the first sovereignty concern, but it often delivers a quick, visible result. FirstCoreAI's four solution lines each work on their own, and most organisations combine two or three. The simplest way to test the fit is a FirstCoreAI demo that walks through a complete campaign, from script to publish, in a single session. URL: https://www.firstnet.co.za/knowledge/sovereign-ai/which-organisations-is-studioai-creative-and-content-ai-service-best-suited-to/. Reviewed 2026-10-11. #### Why adopt AI on sovereign South African infrastructure with FirstNet's FirstCoreAI? Because the biggest barrier to AI adoption is trust in what happens to your data. When assistants run on the Sovereign AI Factory from FirstCoreAI, FirstNet's AI business unit, prompts, documents and outputs are processed in South Africa on infrastructure FirstCoreAI owns and operates, which removes foreign-jurisdiction and data-export concerns before you start. Most AI projects stall between the pilot and everyday use: people are unsure what they may share, data ends up in foreign services and nobody owns the outcome. Adopting on sovereign infrastructure removes the biggest risk first, so the work can focus on making AI genuinely useful. What sovereign hosting adds: - Inference runs on GPUs in FirstNet's South African data centre. - POPIA-aligned by design, because prompts and documents are processed in the country. - Data held by foreign providers can fall under foreign law, such as the US CLOUD Act; local hosting keeps access with the people you authorise. - Open-weight models, so you are not locked into a foreign platform. - Rand-denominated commercials with no exchange-rate surprises. FirstCoreAI pairs this with role-based training, AI governance and change leadership, so private assistants move from pilot to everyday use. URL: https://www.firstnet.co.za/knowledge/sovereign-ai/why-adopt-ai-on-sovereign-infrastructure/. Reviewed 2026-10-10. ### Support #### How do I escalate a support request with FirstNet's Rapid Response Service Desk? You can escalate any active FirstNet support request at any time. During business hours (Mon–Fri, 08:00–17:00 SAST) email escalations@firstnet.co.za; after hours, on weekends and on public holidays call 0861 924 686, which is available 24×7. FirstNet also escalates internally on your behalf. For Priority 1 incidents, automatic internal escalation happens at 2 and 4 hours, and you can still escalate yourself at any time. Every request has a reference number that stays with it until it is closed, which identifies the request you are escalating. During a P1 incident you can also expect: - For P1 incidents: a first response within 30 minutes, 24×7. - Proactive updates at least every 30–60 minutes until service is restored. - One named owner accountable from acceptance to restoration. - A clear statement of whether the service is Restored (working again) or Resolved (root cause fixed). - A written Post-Incident Review within 5 business days, without you having to ask. To log a new fault rather than escalate an existing one, use the Rapid Response Service Desk on support@firstnet.co.za or 0861 989 896, both 24×7. URL: https://www.firstnet.co.za/knowledge/support/how-do-i-escalate/. Reviewed 2026-10-10. #### How do I lodge a complaint or billing dispute with FirstNet? Email your complaint or billing dispute to FirstNet at complaints@firstnet.co.za with your details, your account reference and the reasons for the complaint. For a billing dispute, also include the invoice number and the disputed and undisputed amounts. FirstNet acknowledges a formal complaint within 3 business days and responds in writing within 14 business days. If you are not satisfied with the outcome, you may refer the matter to ICASA, the Independent Communications Authority of South Africa, on 011 566 3000 or consumer@icasa.org.za. The full process is set out in FirstNet's Complaints Procedure, published with its policies and guides on the FirstNet support page. Which FirstNet contact to use: - Formal complaints and billing disputes: complaints@firstnet.co.za. - Billing questions: accounts@firstnet.co.za. - General enquiries: sales@firstnet.co.za. - Faults and service requests: the Rapid Response Service Desk on support@firstnet.co.za or 0861 989 896, 24×7. URL: https://www.firstnet.co.za/knowledge/support/how-do-i-lodge-a-complaint-or-billing-dispute/. Reviewed 2026-10-10. #### How quickly does FirstNet's Rapid Response Service Desk respond to support requests? FirstNet's Rapid Response Service Desk gives a first response within 30 minutes for P1 (critical) and within 1 hour for P2 (major), 24×7. P3 (minor) requests get a first response within 6 business hours and P4 (routine) within 8 business hours. Every request is prioritised by its business impact, and first response is measured from the moment a request is logged: - P1, Critical, 30 minutes, 24×7: service unavailable or severely degraded, critical business impact, no reasonable workaround. - P2, Major, 1 hour, 24×7: service degraded, with significant but partial impact. - P3, Minor, 6 business hours: minor impact on the business. - P4, Routine, 8 business hours: no impact on the business, for example information requests or routine changes. For P1 incidents, FirstNet also provides proactive updates at least every 30–60 minutes until service is restored, one named owner accountable from acceptance to restoration, automatic internal escalation at 2 and 4 hours, and a written Post-Incident Review within 5 business days. For urgent faults, especially P1 incidents, call 0861 989 896. Requests with attachments are best emailed to support@firstnet.co.za. Both channels are available 24×7. URL: https://www.firstnet.co.za/knowledge/support/how-quickly-will-you-respond/. Reviewed 2026-10-10. #### Who can log a support request with the FirstNet Rapid Response Service Desk? Support requests are logged by your organisation's registered Technical Contacts (TCs). They identify themselves when logging a request, give first-level support to their own users and escalate to the FirstNet Rapid Response Service Desk when needed. FirstNet may decline requests logged directly by end users. How logging works: - Email support@firstnet.co.za, 24×7: the best way to log a request with screenshots, trace routes or other attachments. - Telephone 0861 989 896, 24×7: for urgent faults, especially Priority 1 incidents. - Every request gets a reference number that stays with it until it is closed. - Firewall changes must be authorised by your designated firewall Technical Contact. - Data centre access requests are logged by registered TCs at least 24 hours ahead. When logging, include the company name, the Technical Contact and their phone number(s), a description of the incident and business impact, the priority, the affected site or service and when it started, what has been tried so far, and the circuit number, service ID, extensions, hosted service or security platform affected. To add or change a Technical Contact, contact FirstNet. URL: https://www.firstnet.co.za/knowledge/support/who-can-log-a-support-request/. Reviewed 2026-10-10. #### Will FirstNet notify us about network outages and planned maintenance? Yes. Subscribed Technical Contacts receive FirstNet notifications for network or service outages and for planned and emergency changes, with updates at least every 30–60 minutes during an active event. Ask FirstNet to subscribe your contacts. Notifications go to your Technical Contacts (TCs) who are subscribed, so make sure the right people are on that list. TCs are also the people who log and escalate requests with the Rapid Response Service Desk. During a Priority 1 incident you can also expect: - Proactive updates at least every 30–60 minutes until service is restored. - One named owner accountable from acceptance to restoration. - A clear statement of whether the service is Restored (working again) or Resolved (root cause fixed). - A written Post-Incident Review within 5 business days, without you having to ask. Changes on your side work the other way round: log planned changes that affect business processes at least 48 hours in advance, so the work can be prepared and tested. If you notice a fault that has not been announced, log it with the Rapid Response Service Desk on 0861 989 896 or support@firstnet.co.za, both 24×7. URL: https://www.firstnet.co.za/knowledge/support/will-i-be-told-about-outages-and-planned-maintenance/. Reviewed 2026-10-10.