What we have checked, and what is still ahead
In testing: production security, RSL manufacturer, supplier and EBS accreditation and legal compliance sign-off remain prerequisites for live use.
Current evidence
The lab engine has been tested against our mock gateway, and the cloud connectors have been exercised in sandbox and demo accounts. These checks do not prove live authority acceptance or the security of a multi-client production service.
Controls in the approved build plan
The plan calls for encrypted connections, encrypted client credentials and signing keys, account roles, tenant separation and an audit trail. Owners and Apex staff will need two-step sign-in. These controls must be tested before we describe them as operating safeguards.
Data location and access
A production host has been provisioned in Johannesburg, South Africa. That is a hosting decision, not proof that every copy of your data stays there. The data-flow, backup and service-provider register still needs legal review. We will publish the privacy notice before registration opens to the public.
Approval before live use
Apex account approval is separate from permission to send fiscal documents. No demonstration QR code is evidence of RSL acceptance. Live use needs the applicable RSL manufacturer and supplier accreditation, accreditation of the specific EBS, taxpayer EBS registration and an internal activation grant for the taxpayer, device and environment. An Apex grant is not RSL permission. Source: https://www.rsl.org.ls/lekuka/documents (Regulations 6–10 and 13–14; checked 28 October 2026).
Your next step
Let’s talk about your business.
Share the systems you use. We will review your request to join testing.