Privacy information

Last updated: 24 October 2026

This page describes the data handled by the current NPS-GeoRisk service. It is not a claim that the service collects no personal information.

Accounts and sign-in

The account service stores usernames, salted password hashes, account roles, enabled/disabled status, account creation timestamps, and session-revocation versions. Successful logins and administrative account changes are recorded in an audit log. Passwords are not stored as plaintext in the user database.

Failed login attempts are tracked using a username, IP address, and timestamp to limit repeated attempts. The active rate-limit window is 15 minutes; older attempt records are removed when subsequent login attempts are processed.

Linked MAP accounts

An administrator may link your navigation account to an existing MAP_Hexagon UID. The backend retrieves the corresponding personal API key over a signed HTTPS interface and stores it encrypted, along with the UID, linked account name, and synchronization timestamp. The key is used server-side and is not displayed or returned to your browser.

Requested H3 lookups are sent to the MAP service using that linked account. The MAP service can record API activity, cell usage, and credit charges. Administrators should link only accounts you are authorized to use. Removing the link deletes the stored key from your navigation account, but does not delete the source MAP account or its historical records.

Approved datasets and device preferences

The navigation backend stores datasets approved for your account and one administrator-assigned dataset per device. The super administrator manages account permissions; account administrators assign device datasets. Devices show only their current assigned dataset and cannot change it. Dataset approvals and administrator assignment changes are recorded in audit history. Lookups use the linked account's server-side MAP API credential, without exposing it to the browser.

Navigation device cookies and approval

Navigation assigns a UUID to each browser profile and stores its signed value in a secure, HTTP-only cookie restricted to nav.georisk.co.za. The server stores the UUID, creation and last-activity times, inactivity expiry, and any administrator-approved account link and optional device name. A single-use eight-character code, valid for 24 hours, lets an administrator approve that browser.

Visits renew the cookie with a requested 400-day lifetime; browsers can enforce shorter limits or remove it. Live device records are deleted after 180 days without activity. You can select This device / Device in Navigation and Forget this device to remove the cookie and live server record. Administrators can revoke approvals. Protected backups and administrator audit history may retain historical records under the applicable retention policy.

Session cookies

An essential, signed session cookie is shared between the GeoRisk application subdomains. It is marked Secure, HttpOnly, and SameSite=Lax. It carries account/session identifiers and a form-security token, not your password. Sessions expire after eight hours. Signing out revokes your account's current sessions on all devices.

Searches, routes, and location

Search text and route coordinates are sent to the locally hosted services to provide results. If you activate the live risk score and grant browser location permission, or have previously granted location permission in your browser, your coordinates are sent to the risk service for a South Africa coverage check and, when supported, a score. For supported locations, a locally hosted OpenStreetMap geocoder uses the approximate H3 cell center to provide a suburb or town label; street addresses are not displayed. Out-of-coverage attempts do not receive a risk score; an approximate H3 cell, timestamp, IP address, and browser user-agent may be retained in the administrator enquiry audit for up to 90 days. Open GeoRisk tabs can notify one another that location access is available, but they do not share coordinates with one another.

Custom place names, coordinates, and descriptions are stored in a shared place database and can be accessed by other authorized users. Do not enter sensitive personal information or private locations unless you have permission to share them.

Operational logs

Nginx and the application services maintain operational logs. These may contain IP addresses, request URLs and search parameters, timestamps, browser information, response codes, and errors. These records support troubleshooting and security. A fixed retention period for operational logs and account audit records has not yet been published.

External providers

Cloudflare handles public website traffic and may process connection and request metadata under its privacy policy. Map tiles are loaded directly from the selected provider, so that provider can receive your IP address, browser/request metadata, and the map areas requested.

The default provider is OpenStreetMap; see the OpenStreetMap Foundation privacy policy. Selecting another map layer or using nearby-point-of-interest queries can send requests to that provider or the Overpass API. External links are governed by the destination site's policies.

Access, correction, and deletion

For questions about your information or to request account correction, disablement, or deletion, contact the administrator who provided your account. Administrators can manage account records. Deleting an account does not automatically remove operational logs, audit records, shared custom places, or existing backups.

Changes

This information may be updated as the service changes. Review this page for the current description and contact your administrator if anything is unclear.