Code of Conduct

← Back to the Trust Centre

1. Purpose

This code sets out the standards that everyone at xlabs (Pty) Ltd ("xlabs", "we") holds themselves to in building, running and supporting Clara. It covers how we treat the information organisations trust us with, how we work with customers and each other, and what happens when something goes wrong.

It sits alongside the Clara POPIA Statement and privacy policy. Where those documents set a stricter rule, the stricter rule applies.

2. Who it applies to

This code applies to:

• Everyone employed by xlabs, including directors.
• Contractors and anyone else who works on Clara on our behalf.
• Anyone given access to Clara systems, customer data or xlabs information to do their work.

By 30 November 2026, everyone covered by this code will confirm in writing that they have read it, and anyone joining after that will confirm before they are given access. They confirm again whenever it changes materially. The Information Officer keeps these records.

3. Our standards

• Be honest. Describe Clara as it is. We do not claim features, certifications or results we do not have.
• Be careful. Treat every record in Clara as belonging to the organisation that put it there, and to the people it describes.
• Be accountable. Own mistakes, report them early and help fix them.
• Be respectful. Treat customers, their clients and colleagues fairly and with courtesy.
• Follow the law, including POPIA, and every agreement we have with our customers.

4. Confidentiality

Confidential information includes anything not meant to be public: customer data, the content of connected email and documents, contracts and pricing, security details, and xlabs's own plans and code.

• Use confidential information only for the work you are doing for xlabs or the customer.
• Do not share it with anyone who does not need it for that work, inside or outside xlabs.
• Do not copy customer data to personal devices, personal accounts or tools xlabs has not approved.
• Do not discuss a customer, their clients or their records in public, on social media or with other customers.
• Never name a customer in examples, demonstrations, test data or product notes without their written permission.

These duties continue after your work with xlabs ends. On leaving, you return or delete all xlabs and customer information you hold, and your access is removed. By 30 November 2026, every departure will follow a written leaver checklist, in line with the Access Control Policy.

5. Access to customer data

Clara is built so that people see only what they need. We apply the same rule to ourselves:

• Access customer data only when a task requires it, such as a support request from the organisation, and only as much as the task needs.
• Never use your access to look up people or records out of curiosity or for personal reasons.
• Use only your own account. Never share passwords or sign-in codes, or use someone else's access.
• Every change to key records is written to an audit log, whatever made the change. Work on the assumption that your actions can be reviewed.

Each organisation's data is held in its own separate database. Moving data between organisations is never allowed.

6. Secrets and security

• Store passwords, API keys and connection secrets only in the encrypted vault provided for them. Never paste them into email, chat, documents or code.
• Keep devices used for xlabs work locked, up to date and protected.
• Run security tests that sign in or write data only on environments set aside for testing, never against a customer's live data.
• Report a suspected security problem straight away, even if you are not sure. Do not try to investigate it alone or keep it quiet.

7. Working with AI

Clara prepares work for a named person to approve. We keep that principle in how we build it:

• Client-facing sends, payments and accounting writes run only after a named person approves them. Do not build or use shortcuts around that approval.
• Send AI services only the content needed for a result, and only through the providers xlabs has approved.
• Do not use customer data to train general-purpose AI models.
• Check what an AI produces before relying on it. You remain responsible for your work.

8. Conflicts of interest and gifts

• Tell the Information Officer about any interest that could affect, or look like it affects, your judgement, such as a stake in a supplier or competitor.
• Do not accept gifts, hospitality or payments that could influence a decision, or that a customer or supplier might see as doing so.
• Never offer or accept a bribe, in any form.

9. Fair treatment

We do not tolerate harassment, bullying or unfair discrimination on any ground, including race, gender, sex, pregnancy, marital status, ethnic or social origin, colour, sexual orientation, age, disability, religion, conscience, belief, culture or language. This applies to how we treat colleagues, customers and their clients.

10. Raising concerns

If you see something that breaks this code, the law or a customer agreement, raise it with the Information Officer at miles@xlabs.co.za. You may do so in confidence. The Information Officer is currently the only channel for raising concerns.

We look into every concern raised in good faith, and no one is treated unfairly for raising one. Where a concern involves personal information, we follow the security compromise process in the POPIA Statement.

11. Breaches of this code

A breach of this code is taken seriously. Depending on what happened, it may lead to access being removed, disciplinary action, the end of a contract or employment, or a report to the authorities. Where a breach affects a customer, we tell the organisation as its agreement with us requires.

By 30 November 2026, every employment and contractor agreement will refer to this code, and breaches will be handled under the disciplinary process those agreements set out.

12. Contact

Information Officer, xlabs (Pty) Ltd
Miles Marshall, CEO
miles@xlabs.co.za
Information Regulator (South Africa): inforegulator.org.za

13. Review

We review this code at least once a year, and whenever how we work changes materially. The version and effective date above identify the current version.