RELEASE 2 · v2.21 · 2026-07-23 · Review copy — do not distribute · POL 986 AED
Ionity Global · Client briefing

The audit is complete.

Enter the authorised client workspace to review the final Phase 1 findings, evidence, financial case, target-state DOME direction, and recommended next actions.

Shout-It-Now NPCRelease 2 · v2.21Confidential client material

Client access

Sign in with an approved Shout-It-Now or Ionity Google or Microsoft account, or use the account details provided with the briefing.

or

Approved organisation accounts get instant passwordless access.

This sign-in screen controls presentation access in the browser. Repository access remains protected by the private GitHub organisation repository.
Ionity GlobalIONITY× SHOUT-IT-NOW
Final Audit Presentation
ACT 0 · OPENINGConfidential — Client
←→ navigate · M index · A ask IONA · P print all
Mission Index

Every view, one map.

Ionity Global logo
IONITYGlobal (Pty) Ltd · AEDI · Building Tomorrow, Today
IT Systems Audit · Phase 1 → Final

The Findings are in.
Now the Gains begin.

The end-to-end IT audit for Shout-It-Now NPC — 21 systems, closed and costed. The money, the low-hanging fruit, and the engineered exit from AWS onto Ionity Private Intranet hosting, with Azure retained as the backbone.

IONITY GLOBAL
prepared for
EngagementQ021-SN01-AD1-26D
DocumentDOC-2026-07-021 · RELEASE 2 · V2.21
Date23 July 2026 · SAST
AuthorIonity Global (Pty) Ltd
Webwww.ionity.co.za
Document Control

On the record, under governance.

Identity

Document ID
DOC-2026-07-021
Version
1.1 — FINAL (presentation layer · Exco review 22 Jul folded in)
Engagement
Q021-SN01-AD1-26D · QTE-2026-002
Classification
CONFIDENTIAL — CLIENT
Governance
Policy 986 AED · AED 900 · TM
Author
Ionity Global (Pty) Ltd · AEDI
Prepared for
Shout-It-Now NPC — L. Monji · N. Daya · P. van Papendorp

Primary evidence repository 485 files · audited

Presentation layer of the consolidated audit. The complete non-secret evidence set is versioned in SHOUTITNOW-AUDIT-REPO beside this file. The Annex remains a curated client view; the primary repository is the full record.

  • Reports: Final Report Phase 1 v3 · SPINE v0.2 · IT-Audit Report-01 · Website Audit SIN-WEB-2026 · Finance Internal Audit (W2) · SmartSuite Recommendation
  • 14 System Profiles: SMART 2 · SNowI · CHOMI · iShout · MojaMind · Sage · Fusion · SSRS · M365 · FreshService · eLearning · Data Warehouse · Snipe-IT (F-28)
  • Quotes & scope: ION-QUO-001 (v4/v5/MULTI) · ION-QUO-002 · Phase-1 Quotation · IT-Audit Scope Ref · QTE-Audit-Questions · Annexure A
  • Forensic: IA·MCP scan outputs · evidence index · System Assessment Apr-2026
  • Legal: Mutual NDA v1.2 (signed) · SLA v1.0 · SOW · Compliance Questionnaire v3 · New Vendor Form
  • Meeting reports: ION-MMR-2026-01→17 series · 8× Word summaries · 30+ notes & Notion pages (Jun–Jul 2026)
  • FLOW & AI: Shout Flow Operational Research Protocol · Dashboard/NACOSA proposal · DOME cost models
  • AWS evidence (20 Jul): cost & usage CSV · IAM users CSV · region check · SMART 2.0 user guide · Change Mgmt Plan v1

Figures marked indicative are drawn from recorded register costs and audit estimates; vendor quotes to confirm at sign-off. This page prints — press P for the full paged document.

Audit Repository Context

Overall context and folder-level findings.

Overall Context

This audit workspace combines executive reporting, evidence artifacts, meeting records, financial assessments, and implementation alternatives into one controlled delivery set. The structure supports two objectives: board-level decision clarity and traceable technical evidence for follow-through.

Repository Shape

The delivery is split between a working stream and a consolidated repository stream. The working tree preserves operational history and duplicates from collection phases, while the consolidated tree is curated for stakeholder handover and sign-off.

Finding Theme

Across folders, the pattern is consistent: spending is fragmented, governance is uneven, and high-impact savings exist. The strongest gains come from de-duplication, platform consolidation, and controlled migration out of high-risk cost zones.

Folder-Related Findings

01_Final_Reports
Final reports are present and decision-ready, but version spread indicates parallel drafting before convergence.
02_Finance_Audit
Cost and audit records expose duplicated spend lines and consolidation opportunities that feed the recurring savings model.
03_System_Profiles
System profiles provide broad coverage; several tools show overlap or low-value retention against current operating priorities.
04_Assessment_*
Assessment and alternatives content supports migration sequencing, but confirms dependency risk if governance controls lag execution.
08/09 Meetings & Notes
Meeting artifacts are rich and consistent, enabling evidence-backed decisions; however, action closure discipline must stay strict to protect momentum.
10/12 AWS Evidence
Cloud evidence confirms urgent risk posture and validates the financial case for a controlled AWS exit and hardened target-state operations.

What This Means

  • Context is now explicit from executive summary down to evidence folders.
  • Findings are mapped to repository domains, not treated as isolated observations.
  • Savings governance linkage is strengthened for board review and implementation control.

Use this page as the handoff bridge between strategic narrative and source-folder evidence during reviews.

Executive Summary — the one-pager

A capable estate, paying for its past —
with a funded path out.

The verdict

Mission-critical delivery works — mobile clinics run on SMART 2.0 daily. But posture maturity is “Initial”: fragmented finance, dormant paid-for tools, no maintenance cadence on the clinical core, and a cloud perimeter left unguarded — CloudTrail dark, a root key without MFA, security groups open to the internet. Residency itself checked out: af-south-1, confirmed.

The money

~R1.2m/yr total IT run-rate — of which ~R620k is flagged poor value (fragmented, duplicated, dormant). The audit banks ≈R335k/yr recurring gains and removes an AWS cliff worth up to R630k/yr from Sep 2026.

The move

Exit AWS entirely. Clinical core to Ionity Private Intranet hosting on micro-computing nodes — POPIA-resident by design. Azure is retained as the productivity & identity backbone; what fits moves there under a R25,000 migration-absorption barrier carried by Ionity.

Act now (30 days)

Enforce MFA (0/6 on AWS) · reconcile the 1,000+ Entra identities vs ~260 active users · resolve the WordPress POPIA breach (F-30) · close the email-security gap · decide the AWS exit before the Sep-26 window.

Bank the fruit (90 days)

Decommission dormant Snipe-IT (R72k/yr) · retire the never-live Data Warehouse (R60k/yr) · right-size the shared RDS · confirm the finance consolidation path.

Build forward (6 months)

Stand up the Ionity intranet cluster in parallel · migrate AWS workloads with zero clinic downtime · land the estate at a ~R285–320k/yr run-rate.

The audit, in numbers

Twelve figures that tell the whole story.

0
systems assessed across internal & client-facing tracks
0+
register findings F-01→F-27 consolidated · live additions F-28–F-30 logged in-deck
R1.2m
total annual IT run-rate across the estate (client finance view)
R0k
of it flagged poor value — sprawl, duplication & dormant tools
7–8×
AWS cost multiple if the commitment lapses in Sep-2026 (R9k → R60–70k/mo)
0/18
of 18 AWS regions with CloudTrail logging disabled — no Config, no GuardDuty (F-23)
Email
email-security gap — risk of not all employees covered (F-04)
2
paid-for systems found dormant — Snipe-IT & the Data Warehouse
R0k+
per year of identified recurring gains — the ledger, itemised inside
R0k
per year of AWS cliff exposure removed by the exit
~0 mo
payback on the Ionity intranet cluster vs today's AWS run-rate
R0k
Azure migration-absorption barrier — carried by Ionity, not the client

Sources: consolidated system register & profiles (QTE-2026-002), findings register F-01→F-27 (Phase 1 v3), cost model baseline ≈R213k/yr (F-07-gated), progress minutes 26 Jun 2026 (~R620k poor-value subset); full run-rate ≈R1.2m/yr from summed system costs (finance view); AWS console-verified 20 Jul 2026. Indicative pending final vendor confirmations.

Methodology

Five foundations. Ten pillars.
Optimise-and-consolidate before replace.

General Foundations every system

01
Asset inventory — hardware, software, shadow IT
02
Security & access controls — MFA, least privilege
03
Backup & disaster recovery — proven by restore
04
Network performance & capacity headroom
05
Compliance & policy enforcement

RYG-rated per system · 5×5 likelihood × severity risk matrix · findings stated as observed, or “requires confirmation”.

Specific Pillars custom · multi-cloud · AI · sensitive data

01
Integrations & data flows — risk lives in the seams
02
Vendor & source-code custody
03
Cloud configuration posture
04
Logging, monitoring & IR readiness
05
Identity lifecycle — joiner / mover / leaver
06
Patch & change management as processes
07
Data classification, retention & destruction
08
AI & model governance
09
Architectural single points of failure
10
Cost & licence rationalisation — surface savings

Evidence: stakeholder interviews, the Apr-2026 assessment workbook, AWS / Azure / M365 scans, and the IA·MCP forensic engine.

The Instrument

IA·MCP — Ionity's forensic audit engine, pointed at your estate.

Beyond interviews and workbooks, the estate was swept with IA·MCP v1.7.0 — Ionity's in-house audit engine: 20 forensic tools driving a connect → harvest → score → report chain, with every run recorded to an evidence locker for drift comparison.

connect_estateiam_reviewlog_review run_auditcloud_audit_jobweb_audit remediation_ticketscompliance_driftrecord_audit +11 more

Framework alignment baked in: CIS v8 · ISO/IEC 27001:2022 · SOC 2 · NIST 800-53 r5 · POPIA — 100 controls evaluated per run, RBAC-gated (auditor / architect), reports kept private under Policy 986 AED.

Engine verification runs (deterministic, rule-based scoring): estate-pattern posture 33.7/100 · cloud-audit job 49.1/100 — both Grade F, maturity “Initial”. Estate-specific outputs live in the evidence index (Appendix C).

What the engine confirmed

  • Maturity “Initial” — controls exist by accident, not by design
  • Dual-cloud split posture — identity in Azure, clinical in AWS, monitoring in neither
  • No centralised logging — POPIA §22 notification would be hard to meet in time
  • A clean, scriptable migration surface — the estate is basic and movable: the exit is low-complexity
Systems Landscape

21 systems — mapped by criticality and destiny.

Every chip carries its future: INTRANET moves to Ionity private hosting · AZURE lands in the retained Microsoft estate · CONSOLIDATE folds into the finance backbone · RETIRE stops costing money.

Critical

SMART 2.0 · clinical hub SNowI 2 · follow-up CRM CHOMI / AIMEE · GBV bot S-Cube · payroll & T&A

If these go dark for 24 hours, field clinics and payroll stop. They lead every decision in this report.

High

iShout · AGYW app eLearning · built, dormant MojaMind · e-art MH M365 · Azure AD Sage Evolution V9 Fusion · DoA control

Sensitive-data platforms and the finance spine — the consolidation battleground.

Low–Medium

Snipe-IT · dormant Data Warehouse · never live Salesforce · leads only SSRS · reporting FreshService · helpdesk WhatsApp · channel

Where the dead spend hides — two of these are paid for and switched off.

Hub & spokes

SMART 2.0 is the anchor: SNowI 2, ShoutLink, iShout, eLearning and MojaMind all reference its shared AWS environment. Move the hub, and the spokes follow in one motion — one migration, five systems.

Time-sensitive

The AWS commitment window (Sep-2026) and the email-security gap reward action this quarter. Everything else can follow the phased plan.

Baseline Posture

Where the estate stands — before the plan lands.

33.7/100
IA·MCP posture score — Grade F · maturity “Initial” · 100 controls evaluated
49.1/100
Cloud-audit job score — dual-cloud configuration & IAM posture sweep
83/100
Projected posture after the roadmap — patched core, resident data, single ledger, live monitoring

Drag: hygiene

0/6 IAM users with MFA · root key without MFA · CloudTrail dark in 18/18 regions · monitoring capped to a 24-h real-time window (cost) — no historical log retention · 4 dormant/vendor accounts still enabled · keys unrotated for 4+ years.

Drag: structure

Five parallel finance tools · dual-cloud with split identity · SPOF concentration on one vendor.

Lift: the plan

Every remedial line in this deck moves one of these gauges — and most of them pay for themselves.

Engine scores are deterministic rule-based calibration values; the projected score assumes full quick-win + migration delivery. Formal ISO/IEC 27001 gap percentages live in §8 of the written report.

I
Act One

Findings — what the audit surfaced.

Twenty-seven register findings — F-01 to F-27 — risk-scored, POPIA-mapped, scan-evidenced. None are alarmist; every one arrives with its remedy priced.

The registerF-01 → F-09 heat view
Deep divesResidency · Patching · The AWS cliff
People & processEmail security · Identity lifecycle
Dead spendSnipe-IT · Data Warehouse · billing anomaly
Consolidated Register

Fourteen board-level lines, one heat map.

ID
Domain
Finding
RYG
Prio
POPIA
F-24
IAM / root
Root key + all 6 IAM users without MFA (0/6); dormant & vendor accounts still enabled; keys aged 1,374–1,633 d — console-confirmed 20 Jul
RED
P1
C7
F-28
Identity / Azure
Azure Entra ID shows 1,000+ user objects vs ~200 mailboxes — stale/guest/duplicate sprawl, unMFA'd, licence & POPIA exposure
RED
P1
C7 · C8
F-29
AI / POPIA
CHOMI (GBV bot) on Botpress cloud + offshore LLM — special PI crosses border twice; no operator agreements; “anonymous” vs special-PI mismatch
RED
P1
§72·C7·C8
F-30
Web / POPIA
WordPress site data leaving South African data storage — cross-border POPIA breach confirmed at the Exco review (22 Jul); remediate hosting & storage residency
RED
P1
§72 · C7
F-23
Cloud logging
CloudTrail disabled in all 18 regions; no Config or GuardDuty — no record of API activity
RED
P1
C7 · §22
F-25
Network
Internet-open security groups (0.0.0.0/0) on the sync and enrolment tiers
RED
P1
C7
F-26
Data exposure
S3 bucket “shoutitnow-hosted-content” publicly accessible via bucket policy
AMBER
P2
C7
F-04
Email security
Phishing exposure — risk of not all employees covered
RED
P1
C7
F-07
Cost / licence
AWS commitment expires Sep-2026 — R9k/mo can spike to R60–70k/mo (with F-06 cost exposure)
AMBER
P1
—
F-27
Resilience
Clinical RDS (sn-sql-db-01) is Single-AZ — no automatic failover on the hub database
AMBER
P2
C7
F-02
Vendor custody
Supplier / developer concentration on the clinical core — active knowledge loss underway
AMBER
P1
C7
F-09
Finance
Finance systems not fully integrated — five parallel tools, no single ledger (with F-10 Sage V9 EOL)
AMBER
P2
—
F-03
Identity
HR → IT joiner/mover/leaver gap — 4 of 6 IAM users dormant yet enabled (incl. external vendor, 1,012 d); orphaned access confirmed
AMBER
P2
C7
F-17
Cloud / POPIA
Residency CONFIRMED — clinical DB in af-south-1 (30 Jun 2026); §72 closed. Residuals: SNowI 2 store · eu-west-1 test box
GREEN
✓
§72

Numbering and RYG per the consolidated Final Report Phase 1 v3 register (F-01→F-27), plus F-28 (Entra sprawl) from the 20 Jul console review and F-30 (WordPress POPIA) from the 22 Jul Exco review. Residency (F-17) confirmed by the AWS configuration scan — Trusted Advisor evidence, 30 Jun 2026. Selection above: the board-relevant lines — the complete register is Appendix B.

Finding F-17 · GREEN · confirmed by scan, 30 Jun 2026

Residency: confirmed in-country.
The scan found the real fires instead.

af-south-1 · Cape Town§72 closed — primary dataset2 residuals open

Confirmed: the AWS configuration scan verified the SMART 2.0 clinical database (sn-sql-db-01) is hosted in af-south-1 (Cape Town) — with all S3 buckets and primary compute in-country. The previously drafted cross-border concern is resolved: rated GREEN.

Residuals to close: verify the SNowI 2 data store (the account holds a single RDS instance) — and the eLearning/Moodle test instance in eu-west-1 (Ireland), now confirmed live and billing every month on the account’s own cost explorer (console check, 20 Jul 2026). Verify it holds no personal information, evidence the check, then terminate or re-home it to af-south-1 / the cluster.

Governance intact: special-PI scope (F-18), minors & the Children’s Act (F-19), HPCSA (F-20), operator agreements (F-21) and funder mapping (F-22) remain the compliance workstream around this now-resident data.

What the same scan surfaced

  • F-23 — CloudTrail disabled in all 18 regions; no Config, no GuardDuty. Nobody would see a breach.
  • F-24 — root access key in use, no MFA, unrotated keys.
  • F-25 — security groups open to 0.0.0.0/0 on the sync & enrolment tiers.
  • F-26 — S3 bucket shoutitnow-hosted-content public via bucket policy. F-27 — clinical RDS Single-AZ, no failover.

Quick win (§7.1): enable multi-region CloudTrail + Config + GuardDuty, retire the root key, close the security groups, fix the bucket policy — days, not months. The intranet design answers F-27 with its HA database pair.

Evidence: AWS Trusted Advisor “CloudTrail Management Events Logging” — 18/18 regions Red (30 Jun 2026); AWS configuration scan per Final Report Phase 1 v3, §F-17 / F-23–F-27. Live console check (20 Jul 2026): EC2 cost explorer shows exactly two active regions — af-south-1 + eu-west-1 (≈$9–10/mo, persistent 6 months; e.g. Mar-26: $30.27 / $9.37) — and zero EC2 resources in us-east-1. EC2 6-month total $231.58; the material AWS spend sits in RDS & allied services, reinforcing the right-size / exit case.

Maintenance model · feeds F-02 (supplier concentration) & F-06 (AWS cost)

The clinical core has had no maintenance cadence —
for roughly 18 months.

No patch cadence ~18 monthsRuntime EOL confirmed — target .NET 10+Reactive-only maintenance

Observed (working notes): patching on SMART 2.0 has been effectively absent for ~18 months, with the runtime confirmed out of date and exposed at the Exco review (22 Jul) — update path set to .NET 10 or above. The mobile-clinic sync layer is maintained reactively by two individuals, with no vendor SLA on the most critical integration in the estate (ties F-02).

Why it matters: every unpatched month widens the exploit window on a system holding special personal information. Combined with no centralised logging, a breach could run undetected — and POPIA §22 notification deadlines would be missed.

Root cause: not negligence — economics. Patching was priced per-incident by an external vendor. The estate needs maintenance as a service with a cadence, not a favour.

Remedy — maintenance by design

  • Ionity managed hosting includes it: monthly patch cadence, staged QA→live, rollback discipline — inside the flat fee (Act III).
  • Now: snapshot + isolate the current instance; schedule the runtime upgrade — Smart2 dependencies to .NET 10+ (Exco action, 22 Jul) — into the migration window so it is done once, properly.
  • Custody: progress the code review & clean handover from the external developer (F-02) in parallel — and verify the runtime version there.
Findings F-06 & F-07 · The ones that gate the money

September 2026: the AWS bill
can jump from R9k to R60–70k a month.

R70kR40kR10k Q3-25Q1-26Jul-26Sep-262027 → committed rate ≈ R9k–17.7k/mo on-demand: R60–70k/mo Ionity intranet: R7.95k/mo commitment expires

This is what pricing volatility looks like

The rate you pay is a temporary discount, not a price. When the commitment lapses, the same servers cost 7–8× more overnight — in USD, at the rand's mercy. The exact commitment type (Savings Plan / RI / EDP) is still unconfirmed by AWS — the bill's own paperwork is uncertain.

Exposure & the exit

Do nothing: up to ≈ R630k/yr of new exposure. Renew: locked into another cycle of the same game — with the posture gaps (F-23–F-27) still your own labour. Exit to Ionity intranet before the window closes: the cliff simply never happens — and the September date becomes your leverage, not your deadline.

Recorded baseline: SMART 2.0 AWS ≈ R9k/mo infra; blended AWS-linked run-rate ≈ R213k/yr (cost model, F-07-gated). Spike range from audit minutes: R60–70k/mo on-demand equivalent. Console-verified 20 Jul 2026: the account bills $529.38/mo avg (Cost Explorer, Jan–Jun 2026) — the committed-rate line is real. ZAR figures indicative; USD-billed services carry FX risk on top.

Findings F-04 & F-03 · the human seams

160 unguarded mailboxes.
Accounts that outlive their owners.

F-04 — Email security gap RED · live phishing observed

Email-security licensing leaves a coverage gap — the risk of not all employees covered. Live phishing exposure was observed during the audit. Every unprotected mailbox is a doorway to the estate — and to funder trust.

Protected~40 mailboxes
20%
Exposed~160 mailboxes
80%

Fix: verify exact licence counts → true-up or right-size · enforce MFA everywhere · phishing-drill the organisation. Exco 22 Jul: ~40 of 200+ staff on Mimecast confirmed; contract notice believed 90 days — confirm, then initiate consolidation onto the Azure stack if that path is taken.

F-03 — Identity lifecycle gap AMBER · C7

No automated joiner-mover-leaver flow between HR and IT. Departed developers built or held SNowI 2, CHOMI and iShout — some credentials were never rotated; a password-protected credentials file sat unopened during the audit.

  • Rotate every key touched by departed staff / vendors — this week, zero cost
  • Wire HR events → Azure AD (retained estate) for automated deprovisioning
  • Individual, logged accounts on SSRS — retire the shared-credential login
Findings F-24 & F-03 · live IAM console capture, 20 Jul 2026

Six users. Zero MFA.
Keys older than the clinic vans.

IAM user
MFA
Last activity
Password age
Active key age
Status
ficky.mathebulaeLearning developer
✗ none
never
1376 d
1376 d · unused
key live
gareth.chandler@int32.co.zaexternal vendor (int32 · MojaMind)
✗ none
1012 d
1630 d
—
vendor · enabled
pierre.vanpapendorpfinance
✗ none
1515 d
1516 d
—
dormant
takudzwa.mabande—
✗ none
1322 d
1633 d
1633 d · unused
dormant · key live
gino.janari—
✗ none
292 d
1633 d
—
dormant
neetin.dayaIT operations · active admin
✗ none
19 min ago
849 d
1374 d
active · no MFA

0 / 6 MFA

Not one account — including the active IT-operations admin — carries multi-factor. A single phished password is full console access to the clinical estate.

4 dormant, still enabled

Four users idle 292–1,515 days, all still console-enabled — including an external vendor (int32) untouched for 1,012 days. Textbook F-03 orphaned access.

Keys never rotated

Active access keys aged 1,374–1,633 days; two never used once — standing secrets that only widen the blast radius. Retire on sight.

Fix — this week, zero cost: enforce MFA on all six (start with the live admin) · disable the four dormant users & the vendor account · delete the three unused/ancient access keys · then wire HR→Azure AD joiner-mover-leaver so this never re-accumulates (F-03). Exco context (22 Jul): MFA lapsed under adoption pressure and IT capacity — a resourcing problem, not negligence — so the remedy ships as a structured, logged MFA & password-rotation process sized to the team.

Source: live IAM console, account 334982276367, captured 20 Jul 2026 — full table archived in the repository (group 10, IAM CSV). Confirms F-24 (IAM hardening) and F-03 (identity lifecycle) at user level, alongside the root-key finding.

New finding F-28 · RED · Azure Entra ID · console-observed 20 Jul 2026

1,000+ Entra identities.
~200 mailboxes. Who are the rest?

The gap

Azure Entra ID shows over 1,000 user objects — against roughly 260 active users (~200 mailboxes). That is a ~4:1 ratio of identities to people. Each object is a login that can be phished, licensed, or abused — and on an estate with no MFA (F-24) and no logging (F-23), most of them are invisible.

What 800 extra identities usually are

  • Stale leavers never deprovisioned (ties F-03)
  • Guest / external accounts from years of sharing
  • Duplicate & test identities, service accounts
  • Bulk-imported client records living in the directory

Attack surface

1,000+ logins, none MFA-protected, is 1,000+ front doors into the retained cloud — the platform we keep must be the clean one.

Licence & cost

Entra P1/P2 and M365 bill per identity. Hundreds of dead objects can mean thousands of rand/mo in phantom licences — a saving hiding in the directory.

POPIA

If client personal data sits as directory objects, that is special PI in an identity store — Condition 7 & retention (C8) exposure, not just IT hygiene.

Fix: export the full Entra user list · classify (active / leaver / guest / service / client-record) · disable then delete the dead · reclaim licences · enforce MFA + Conditional Access on what remains · make Entra the clean identity spine for the whole estate (feeds F-03 automation).

Console-observed 20 Jul 2026; Exco review (22 Jul) confirmed ~1,000 objects vs ~260 active users — disabled/archived mailboxes hold no licences and were assessed no-intrusion-risk (N. Daya), leaving cleanup, licence reclaim & lifecycle automation as the actions. Logged as F-28, RED, POPIA C7 · C8. Sits alongside F-24 (no MFA) and F-23 (no logging) as the identity-and-visibility cluster.

New finding F-29 · RED · POPIA §72 · C7 · C8 · special PI

Survivor conversations,
crossing the border twice.

GBV survivorsspecial PIBotpress cloud · not SA

Observed: CHOMI — the GBV support chatbot — runs on Botpress cloud (confirmed not Azure, not SA-hosted). Its analytics dashboard shows live LLM calls on real traffic. Every survivor message therefore leaves the country twice: once to Botpress, once to the LLM provider.

The gap: the compliance questionnaire classes GBV data as special personal information — yet CHOMI's snapshot still reads “anonymous / minimal PII”. The FreshService handoff carries name + cell + location, re-identifying an otherwise anonymous survivor.

Custody: built by a departed external developer (Andrew Moore); a credential/password update is still outstanding.

0
users last month
0
sessions last month
0
bot messages
0
user messages — all LLM-processed offshore

Remedy

Operator agreements (POPIA S.20/21) with Botpress and the LLM provider · reconcile the “anonymous” classification to special PI · set retention/destruction on conversation logs · rotate the departed-dev credentials · then execute the recorded direction — move CHOMI to an AI/RAG bot on SA-resident / edge hosting (Ionity intranet + local LLM) so survivor data never leaves the country.

Botpress analytics captured 20 Jul 2026 (repo group 12). Platform confirmed on Botpress cloud per the 19 Jun 2026 platform-decision meeting; special-PI classification per the compliance questionnaire. Logged F-29, RED.

Findings F-09 · F-02 & register observations — structure

Four quiet findings that compound daily.

F-09 · Five finance systems, zero single ledger AMBER · with F-10 Sage EOL

Sage Evolution V9 (EOL-bound), Fusion, CaseWare, S-Cubed and BioSyn run in parallel. Every hand-off is a manual reconciliation point — audit risk, SARS risk, grant-report risk. Remedy: one backbone — Dynamics 365 (NGO ~60% discount) weighed against a Sage upgrade; retain S-Cube; 3/6/9-month staged cut-over.

The sync layer no one owns observed · ties F-02 · F-25

Mobile-clinic offline sync (Symmetric-DS pattern) is fragile and unsupported — kept alive reactively by two people, no SLA. It is the artery between field vehicles and the clinical record. Remedy: a dedicated, monitored SYNC node with health-checks is designed into the Ionity intranet cluster (Act III).

F-02 · Supplier concentration — active knowledge loss AMBER · P1

The clinical core depends on one external developer at ~R350k/yr all-in; SNowI's builder has left; iShout's handover is incomplete; the Data Warehouse supplier went bankrupt. Remedy: code review → escrow → clean handover, then maintenance under contract cadence — dependency reduction as a formal work-stream.

Duplicate clients on special PI register observation

Duplicate client records previously needed a dedicated merge team; fingerprint verification on tablets was bypassed under server load. Data quality on clinical records is a POPIA C3 accuracy duty. Remedy: unified client identity across SMART 2.0 / SNowI / iShout; restore biometric verify capacity on the new nodes.

The dormant estate

Two systems paid for, switched off —
and a bill that reads zero.

Snipe-IT F-11 · dormant

Azure-hosted asset register: licensed at R6,000/mo (R72k/yr), recorded “Active”, not used. No database access — the register can't be recovered from source; the real asset list lives in a manually-updated Excel file.

Recover access → migrate register into the finance system → decommission. R72k/yr reclaimed; Finance finally sees its own assets.

Data Warehouse F-12 · never live

Planned central integration DB on Azure at R5,000/mo (R60k/yr) — never reached production. Supplier (GCT) reported bankrupt, all staff resigned, nobody holds working knowledge. Platform sits paused.

Retire. Point Power BI directly at source databases now; DOME (Phase 2) inherits the integration role. R60k/yr reclaimed.

Azure billing anomaly F-08 · investigate

After a payment disruption and a Microsoft write-off, Azure invoices now read zero. That is not a discount — it is an unquantified liability and a service-continuity risk on the platform we are about to keep.

Regularise before migrating anything in. Confirm the true billing position with Microsoft; move the tenant onto a clean subscription under the retained-Azure plan.

Together: R132,000/yr of pure dead spend — the lowest-hanging fruit in the estate. No user is disrupted; nothing of value is lost.

Deeper pass · findings the first sweep under-weighted

Five more that earn their place on the register.

Two 2-day outages availability

The estate took two separate two-day outages — clinical service delivery in the field stops when SMART 2.0 is down. No documented RTO/RPO, no tested restore. The Single-AZ RDS (F-27) means the next one is a matter of when. Fix: HA database pair + restore drills, built into the cluster.

Website audit — open items SIN-WEB-2026

A dedicated website audit (SIN-WEB-2026-R01) ran in parallel: performance, SEO and security items outstanding on the public site — the organisation's front door to funders and beneficiaries. Fix: close the R01 action list; fold hosting into the managed estate.

Payroll = single point of failure funder-critical

Payroll depends on one person; T&A integration pending; the finance stack auto-assembles IRP5 / EMP501 / UI19 — statutory filings with no bus-factor cover. Fix: cross-training underway; document & integrate S-Cube; confirm the BioSyn API.

Governance & records gaps POPIA · audit trail

~20 auto-transcribed meetings captured empty; operator/processor agreements and data-classification schedules incomplete; SSRS on shared credentials. Decisions and data-handling aren't consistently evidenced. Fix: QMS & records discipline in Phase 2.

Also on the watch-list

Salesforce paying for a full CRM used only for lead capture · Consumate / ASQ / Eduvoss / Baseline internal tools unmapped for integration · departed vendors (Garrett · Peter · GCT) still hold code or knowledge · fingerprint verification bypassed on tablets under server load. Each carries a remedy in the written register.

Sourced from the master summary, meeting minutes (Jun–Jul 2026), website audit SIN-WEB-2026 and the finance internal audit. Full write-ups & IDs in the consolidated report §5–6.

II
Act Two

The Money — gains, itemised.

Where the R620k goes today, the fruit hanging lowest, the full gains ledger, and the run-rate this estate should land on. Every rand traceable to a finding.

Spend mapR620k, system by system
Low-hanging fruitNine picks, effort-rated
Gains ledger≈ R335k+/yr recurring
TrajectoryRun-rate · payback · 3-year view
Spend Map — recorded annual costs

Where the ~R1.2m goes today.

SMART 2.0 all-inAWS infra + external vendor · clinical hub
≈ R350k/yr
iShoutAWS · AGYW app · handover incomplete
R96k/yr
Snipe-ITAzure · asset register · DORMANT
R72k/yr
Sage Evolution V9finance core · 7 users · outsourced VM
R70k/yr
Data WarehouseAzure · never implemented · DORMANT
R60k/yr
CHOMIBotPress · GBV chatbot · 4 languages
R54k/yr
SSRS reportingAfrihost-hosted · shared credentials
R36k/yr
Fusionprocurement / DoA control · 10 users
R24k/yr
MojaMindrides shared SMART 2.0 RDS · R7k/mo recorded
R18–84k/yr*
Microsoft 365~200 mailboxes · Entra · Mimecast
≈ R132k/yr
Payroll & T&AS-Cube · BioSyn · SPOF
≈ R55k/yr*
Azure + Salesforce + connectivityretained cloud · leads · Afrihost · lines
≈ R90k/yr*
FreshService + internal opshelpdesk · Consumate · ASQ · Eduvoss
≈ R56k/yr

Profiled systems total ≈R856k/yr; adding M365 (~R132k), payroll, Azure, Salesforce & connectivity brings the full IT run-rate to ≈R1.2m/yr. *Estimated where the register left the field uncaptured. MojaMind carried at R7k/mo. gold = dormant spend. AWS-linked hosting baseline within these lines ≈ R213k/yr.

Console evidence — Cost Explorer, Jan–Jun 2026 · SMART 2.0 account

The real bill: $529 a month.
Seventy percent of it is plumbing.

Support (Business)premium plan — see card →
$100.00/mo
RDSsn-sql-db-01 · Single-AZ (F-27)
$86.70/mo
Elastic Load Balancingalways-on front plumbing
$83.45/mo
Tax (VAT)shrinks with the bill
$69.05/mo
EC2-OtherEBS volumes · snapshots · transfer
$58.61/mo
VPCNAT gateways — silent burners
$57.96/mo
EC2-Instancesthe actual compute — tiny
$38.48/mo
ECS + S3 + Secretscontainers · storage · 1 secret
$35.13/mo
CloudWatchobservability — unfunded
$0.00

Plumbing vs workload

≈ $369/mo (~70%) is overhead — support plan, load balancing, NAT, volumes, VAT. The workload itself (DB + compute + containers + storage) is ≈ $160/mo. The bill proves the sizing case: this estate is micro-computing-sized.

Premium support, zero eyes

$100/mo for Business Support next to $0.00 CloudWatch across six months — F-23 rendered in currency: paying for help, funding no sight. Downgrade candidate today, before any migration.

The register, validated

$529.38/mo ≈ R9.5k/mo (~R114k/yr) at prevailing rates — within FX noise of the recorded ~R9k/mo. Add iShout’s ~R8k/mo line and the estate AWS baseline of ≈R213k/yr reconciles from live data.

Trim now, pre-migration: downgrade the support plan (−$100/mo) · retire the eu-west-1 box (−~$10/mo) · review the LB/NAT pair (part of −$141/mo) → ≈ R2.5–3.5k/mo back immediately, before a single workload moves.

Source: live Cost Explorer, account 334982276367 — total $3,176.26 over Jan–Jun 2026, avg $529.38/mo, 16 services (captured 20 Jul 2026). Full table archived in the repository — group 10, CSV + evidence note. ZAR conversions indicative (~R18/$).

Low-Hanging Fruit — pick in the next 90 days

Nine picks. No ladders required.

R72k/yr
Decommission Snipe-IT

Recover access → migrate the asset register into the finance system → switch off. Finance gains its single source of truth.

effort low · owner IT + Finance
R60k/yr
Retire the Data Warehouse

Never reached production; supplier defunct. Direct Power BI links to sources now; DOME absorbs the role in Phase 2.

effort low · owner IT + M&E
≈R30k/yr
Right-size the shared RDS

MojaMind rides the large clinical database instance with a tiny footprint. Split to a right-sized instance — the cleanest infra saving pre-exit.

effort low · interim (absorbed by exit)
≈R50k/yr
Consolidate finance licences

Dynamics 365 at NGO ~60% discount (~R20k/yr, 4 users) vs Sage V9 + add-ons ≈ R94k. Net after cut-over, with S-Cube retained.

effort medium · 3/6/9-month staged
R36k/yr
Fold SSRS into the cluster

Reporting moves to the intranet reporting node with individual, logged accounts — retiring the Afrihost line and the shared login (F-SSRS-ACC).

effort low · with migration
R0 · risk↓
Rotate departed-dev keys

Every credential touched by former developers and the bankrupt supplier — rotated this week. The cheapest security win in the estate.

effort trivial · do first
value ↑
Activate the eLearning platform

Built, paid for, dormant. Integrate into iShout per plan — a funded deliverable switched on for free.

effort low · owner programmes
reach ↑
Re-enable iShout DataFree

A data-free app whose zero-rating is disabled undercuts its whole purpose for AGYW users. Confirm cause; restore in the action plan.

effort low · equity win
risk ↓↓
Close the mailbox gap

True-up email security across all ~200 mailboxes; MFA everywhere. Modest licence cost buys the largest single risk reduction available.

effort low · this month
The Gains Ledger — recurring, annual

Every line traceable to a finding.

#ActionSourceAnnual gain
G-1Exit AWS → Ionity Private Intranet (CLINICAL tier, all AWS workloads)F-06 · F-07 · F-23–F-27+ R117,600
G-2Decommission Snipe-IT; asset register into financeF-11+ R72,000
G-3Retire Data Warehouse; direct Power BI source linksF-12+ R60,000
G-4Finance consolidation — D365 NGO pricing vs Sage V9 stack (net)F-09 · F-10+ R50,000
G-5SSRS folded into intranet reporting node (Afrihost line retired)F-SSRS+ R36,000
G-6Shared-RDS right-size (interim until exit completes)§7.5+ R30,000*
G-7Email-security true-up to ~200 mailboxes (risk closure)F-04− cost-neutral
Identified recurring gains — before Phase-3 vendor-dependency savings≈ R335,600 / yr

+ Risk avoided

AWS commitment cliff never fires: up to ≈ R630k/yr exposure removed (F-04).

+ Phase-3 upside

Clinical-vendor dependency reduction after code handover — further recurring saving inside the ~R350k all-in line (F-08).

− One-off costs

Cluster CAPEX R118,500 · migration labour (Ionity-absorbed up to R25k on Azure-bound moves) · D365 onboarding.

*G-6 is interim and largely absorbed into G-1 once the exit completes — totals conservatively count it once. Figures indicative, from recorded register costs; vendor confirmations at sign-off.

Trajectory

From R1.2m to a ~R865k run-rate.

Todayfull IT run-rate · fragmented · dual-cloud
≈ R1.2m / yr
+ 90 daysdormant spend off · RDS & support right-sized
≈ R1.06m / yr
+ 6 monthsAWS exited → Ionity intranet · SSRS folded
≈ R950k / yr
+ 9–12 monthsfinance consolidated · Entra & licences right-sized
≈ R865k / yr
−0%
total IT run-rate cut (≈54% of the poor-value portion) at plan completion
R0k+
recurring annual gains — the ledger, banked
0
clinic-days of downtime budgeted for the entire programme

Baseline ≈R1.2m/yr total IT run-rate (summed system costs); the ≈R335k/yr gains land it near R865k. Poor-value portion specifically falls R620k→~R285k. Excludes one-off cluster CAPEX & Phase-2 build investments (scoped separately).

Payback & the three-year picture — AWS workloads only

One year to payback.
Then it's all gain.

R2.4mR1.6mR800kR0 Year 1Year 2Year 3 break-even ≈ month 12 AWS on-demand: up to R2.34m AWS renewed: R639k Ionity: R405k all-in
3-year totalsCost
Ionity intranet — R118.5k CAPEX + 36 × R7,950R404,700
AWS — commitment renewed at today's blendR639,000
AWS — commitment lapses (R65k/mo avg)R2,340,000
Ionity advantage — vs renewed / vs lapsedR234k / R1.94m

Payback arithmetic

R118,500 CAPEX ÷ (R213k − R95.4k)/yr
= ≈ 12.1 months vs today's AWS
= ≈ 2 months vs the lapsed-commitment rate

Comparison covers AWS-hosted workloads only (SMART 2.0 · SNowI 2 · iShout · eLearning · MojaMind share). Ionity line includes managed service, patching, monitoring & backups; hardware refresh reserve included from year 4. FX risk sits only on the AWS lines.

III
Act Three

The AWS Exit — and the Ionity Private Intranet.

Why the estate leaves AWS entirely, what it moves onto — sovereign micro-computing nodes on your own floor — what that costs, what Azure keeps carrying, and the alternatives weighed honestly beside it.

The caseVolatile pricing · residency · custody
The destinationNode cluster, drawn & priced
The forecastHosting all AWS workloads
The optionsFive paths, one recommendation
The Case for Exit

Four reasons AWS is the wrong home for this estate.

Volatile pricing

Your rate is a commitment artefact, not a price. Sep-2026: R9k → R60–70k/mo if it lapses — and the commitment's own type/expiry couldn't be confirmed during the audit. Billed in USD, exposed to every rand move.

Unguarded perimeter

The 30-Jun scan: CloudTrail dark in 18/18 regions, root key without MFA, security groups open to 0.0.0.0/0, a public S3 bucket (F-23–F-26). Residency checked out — the guardrails around it did not.

Custody & control

The environment is administered through one external vendor relationship (F-08), unpatched for 18 months (F-06). You rent the floor and outsource the keys.

Oversized for the load

The workloads are basic and scattered — a .NET app, a CRM, two content apps, one modest database. Hyperscale elasticity is being paid for; none of it is being used.

The principle

This estate doesn't need a hyperscaler — it needs sovereignty, a patch cadence, and a predictable rand-denominated bill. Own the compute, contract the care. That is precisely what private intranet hosting on micro-computing delivers — next page, drawn to the node.

Exit Inventory

Everything AWS hosts today — and where it lands.

Workload
On AWS today
Destination
SMART 2.0 clinical hub · QA + live · app + RDScritical
App + DB confirmed af-south-1; clinical RDS sn-sql-db-01 Single-AZ — no failover (F-27); fingerprint verify bypassed under load; ~R9k/mo infra.
Ionity intranet — APP + HA DB pair (answers F-27), dedicated SYNC node, biometric capacity restored. Sovereignty by design.
SNowI 2 follow-up CRM · WhatsApp channelcritical
Shares SMART 2.0 environment; departed internal developer; near-real-time referral feed.
Ionity intranet — co-located with the hub it feeds from; credentials rotated during cut-over.
iShout AGYW membership app · R8k/mohigh
AWS-hosted; code stable under Peter after the Softdeck/Softlink handover — no vendor fees currently paid (Exco 22 Jul); DataFree disabled.
Ionity intranet — APP node + public edge via gateway; DataFree re-enabled in the action plan.
eLearning built, dormant · rides SMART 2.0 AWSlow
Complete but unused; inherits SMART 2.0's posture; its Moodle test box runs live in eu-west-1 — billing ~$10/mo, every month (F-17 residual: verify no PI, then kill or re-home).
Ionity intranet — activated on the APP node and integrated into iShout. Paid-for value, switched on.
MojaMind e-art mental-health · pre-go-livesensitive
Rides the shared clinical RDS with a tiny footprint; register already plans an Azure move.
Azure (retained estate) — per its own plan, inside the R25k absorption barrier; joint SU governance kept intact.

Five workloads. One shared environment. One coordinated exit — the hub-and-spoke coupling that made AWS risky makes leaving it simple.

Recommendation R-01 · Ionity Global

Host it yourselves —
we'll run it with you.

Move every AWS workload onto a Private Intranet cluster of micro-computing nodes, installed on Shout-It-Now premises, owned by Shout-It-Now, operated under an Ionity managed-service cadence. Clinical data never leaves the building except by your policy. The bill is flat, in rand, forever indifferent to commitment expiry dates.

R118.5k
once-off — 8-node CLINICAL cluster, installed & hardened
R7,950
per month, flat — managed hosting, patching, monitoring, backups
−55%
vs today's AWS run-rate · payback ≈ 12 months
100%
sovereignty — residency stays in-country by architecture, with logging & HA failover built in (F-23 · F-27 closed)

Building Tomorrow, Today — on hardware you can point at.

Ionity Private Intranet — CLINICAL tier topology

Eight nodes. One living organism.

MOBILE CLINICS · FIELD AZURE · M365 (RETAINED) GATE-1 · EDGE firewall · WireGuard · LTE failover 2.5G MANAGED SPINE · PoE · VLAN-SEGMENTED APP-1 SMART 2.0 web · QA→live 16GB · NVMe · ARM64 APP-2 SNowI 2 · iShout · eLearning 16GB · NVMe · ARM64 DB-1 · PRIMARY clinical DB · encrypted at rest NVMe mirror · PITR DB-2 · REPLICA hot standby · read reports auto-failover SYNC-1 mobile-clinic sync · health-checked owned, monitored sync layer RPT-1 SSRS successor · Power BI feeds individual, logged access BAK-1 immutable snapshots · 3-2-1 restore-tested monthly MON-1 telemetry · alerts · IR runbook POPIA §22-ready logging DUAL UPS · SURGE · 5V/20W-CLASS NODES — THE WHOLE CLUSTER DRAWS LESS THAN A KETTLE

Topology: CLINICAL tier (recommended). Every node is a discrete micro-computer — a failure replaces a R12k part, not a platform. AI-M (Ionity's 5V/20W intelligent motherboard, Q2-2026 line) slots in as nodes refresh.

CAPEX — Bill of Materials, CLINICAL tier

Own the metal for R118,500, once.

ItemSpecCost (ZAR)
GATE-1Edge gateway — firewall, WireGuard, VLANs, LTE failover modem9,800
APP-1 · APP-22 × application nodes — 16GB ARM64, NVMe, active cooling22,400
DB-1 · DB-22 × database nodes — NVMe mirrored pairs, ECC-class storage path26,800
SYNC-1Mobile-clinic sync node — queue + health-check stack11,200
RPT-1Reporting node — SSRS successor, Power BI gateway7,900
BAK-1 + MON-1Backup node (immutable, 3-2-1) + monitoring/telemetry node12,600
NET2.5G managed PoE spine switch + structured cabling6,400
PWRDual UPS, surge protection, LTE data contract setup14,800
BUILDRack/enclosure, assembly, hardening, burn-in, documentation6,600
CLINICAL cluster — installed, hardened, handed overR118,500

Why micro-computing wins here

The whole AWS estate fits in comfortably: a .NET app, a CRM, two content apps, one modest DB. Distributed small nodes give graceful failure (one node ≠ the estate), silent 5V/20W-class power draw, and rand-priced replacement parts on a shelf.

Owned, not rented

Hardware title vests in Shout-It-Now on commissioning. If the Ionity relationship ever ended, the cluster — and every byte on it — stays put. That is the opposite of vendor lock-in (F-08's lesson, applied).

Refresh reality

Node-by-node refresh from year 4, ≈ R15–20k/yr reserve — already inside the managed fee. AI-M boards adopt as they ship.

Ionity Managed Hosting — monthly, flat, in rand

Three tiers. One promise: no cliffs.

CORE
R4,950/mo
R68,500 once-off · 4 nodes
  • Gateway + app + DB + backup nodes
  • Business-hours monitoring · monthly patch cadence
  • Nightly immutable backups
  • Fits: pilot / non-clinical workloads
Recommended — this estate
CLINICAL
R7,950/mo
R118,500 once-off · 8 nodes · R95,400/yr
  • Full topology: HA database pair + dedicated SYNC & reporting nodes
  • 24/7 monitoring · alerting · IR runbook (POPIA §22-ready)
  • Monthly patching, staged QA→live — the 18-month maintenance gap closed for good
  • Restore-tested backups · PITR · off-site encrypted copy
  • 99.5% availability target · hardware refresh reserve included
SOVEREIGN
R11,900/mo
R186,000 once-off · 12 nodes · dual-site
  • Everything in CLINICAL, mirrored across two premises
  • Encrypted DR replica into the retained Azure estate
  • RPO ≤ 15 min · RTO ≤ 4 h, evidenced for funders
  • Fits: post-Phase-2 scale, DOME era

All tiers: rand-denominated, 12-month terms, no usage metering, no egress fees, no commitment cliffs. Up to 68% maintenance saving vs legacy OEM support models (Ionity engagement benchmark). Local AI / offline LLM node available as an option on CLINICAL and above.

The Forecast — all AWS workloads, re-homed

What hosting everything will actually cost.

AWS — if commitment lapseson-demand, USD-billed · Sep-2026 onward
R60–70k / mo
AWS — commitment renewedblended run-rate today · renewal terms unknown
≈ R17.75k / mo
Ionity CLINICAL — year 1R7,950/mo + CAPEX amortised over 36 mo
≈ R11.24k / mo
Ionity CLINICAL — steady stateflat managed fee, rand-priced, all-inclusive
R7,950 / mo

Annual, steady state

R95,400/yr hosts SMART 2.0, SNowI 2, iShout, eLearning and reporting — vs ≈ R213k on AWS today. −55%.

Everything included

Patching, 24/7 monitoring, backups, restore tests, IR runbook, refresh reserve — items AWS bills as your labour.

Zero volatility

No USD exposure, no egress metering, no renewal roulette. The September 2026 date stops being a threat.

Forecast basis: AWS-linked baseline ≈ R213k/yr, console-verified (SMART 2.0 account: $529.38/mo avg, Jan–Jun 2026); workload sizing from system profiles. MojaMind lands in retained Azure per its own migration plan — its hosting is excluded from both sides of this comparison.

Fit-for-purpose engineering

Built for an organisation that runs on wheels.

Offline-first is your native mode

Mobile clinics already work disconnected and sync when signal returns. A private intranet cluster speaks that language natively — the dedicated SYNC node queues, verifies and reconciles field data with health-checks, replacing the fragile unsupported layer (F-07) with an owned, monitored one.

5V/20W-class nodes — NPC economics

The whole cluster draws less power than a kettle and runs silently through load-shedding on dual UPS + LTE failover. Power, cooling and space costs round to noise — a materially different economic base from rack servers or hyperscale rent.

Edge AI-ready — the AI-M path

Ionity's AI-M intelligent motherboard line (5V/20W True-Edge-AI, 2026) slots into this exact topology: local inference for duplicate-client matching (F-09), sync anomaly detection, even an offline LLM assistant for reporting — all without data leaving the building.

Compliance by architecture

Residency is already in-country (F-17, confirmed) — the cluster keeps it that way by architecture, and adds what the scan found missing: §22-ready logging on MON-1 (vs F-23), an HA database pair (vs F-27), and a closed WireGuard-only perimeter (vs F-25). Funder due-diligence answers itself.

This is Ionity's home ground: IoT-grade hardware, ecosystems architecture, and managed edge intelligence — engineered in Centurion, deployed on your floor.

The Move — engineered, not improvised

Parallel-run migration. Zero clinic-days lost.

Weeks 1–2

Stand up

cluster built off-site
  • Assemble, harden, burn-in
  • Runtime upgraded in transit — maintenance cadence starts
  • WireGuard mesh + VLANs
  • Install on premises · dual UPS
Weeks 3–4

Shadow

AWS stays primary
  • Nightly data replication AWS → DB-1
  • QA environment cut over first
  • Field-vehicle sync tested against SYNC-1
  • Restore drill from BAK-1 — evidenced
Weeks 5–6

Cut over

one weekend window
  • Final delta sync · DNS/endpoint swing
  • Clinics resume Monday — same screens
  • AWS kept warm, read-only, 30 days
  • Credentials rotated estate-wide (F-03)
Weeks 7–8

Decommission

the bill ends
  • AWS snapshots exported to BAK-1
  • Accounts closed before the Sep window
  • MojaMind lands in retained Azure
  • Savings ledger starts counting

Rollback, always

Until decommission day, AWS remains a one-command fallback. No burn-the-boats moments on a clinical estate.

Vendor custody handled

Code review & escrow with the external developer run inside the shadow phase (F-08) — the handover happens while both environments exist.

Fixed-price delivery

Migration labour is quoted fixed at Phase-2 sign-off; Azure-bound moves are absorbed by Ionity up to the R25k barrier.

The Retained Estate — Azure & Microsoft 365

Azure stays — as the backbone, not the bill.

What Azure keeps carrying

M365 is embedded and working — Teams, SharePoint intranet, OneDrive, Outlook, Power BI. The direction is optimise, not migrate: identity (Azure AD) becomes the single sign-on spine for the whole estate, including the intranet cluster. Exco 22 Jul: the organisation qualifies for Azure's 75% NPO discount, with additional Ionity–Microsoft partnership discounts on top.

Azure 75% NPO discount — qualified Azure AD — identity spineM365 productivity Power BI reportingSharePoint intranet Mimecast integrationSOVEREIGN-tier DR replica

What moves into Azure

  • MojaMind — per its own recorded plan; joint Stellenbosch governance preserved; lands before its post-intervention handover.
  • Asset register — out of dormant Snipe-IT, into the finance system on the M365/D365 side.
  • M&E datasets — Data Warehouse role replaced by direct Power BI source links now, DOME later.
  • HR → IT lifecycle automation — joiner/mover/leaver wired through Azure AD (F-03).

The R25,000 absorption barrier

Ionity absorbs migration and configuration costs for Azure-bound moves up to R25,000 — MojaMind's landing, the asset-register fold-in, Power BI re-pointing and lifecycle wiring are executed at no charge to Shout-It-Now within that barrier.

Barrier applies to Azure-destination migrations in this plan; drawn against actual hours at cost; unused balance reported at close-out.

Housekeeping before anything moves

Regularise the zero-reading billing anomaly with Microsoft; verify the ~R55/user NBL licence deal; true-up the email-security mailbox coverage gap. A clean subscription is the condition of the retained estate.

Options on the table — the client decides

Five paths for the AWS workloads.
One recommendation, no blinkers.

A
Ionity Private Intranetmicro-computing cluster on premises — recommended
POPIA by design · flat rand pricing · patching & monitoring included · offline-first sync · hardware owned by Shout
R7,950/mo
+ R118.5k once
Recommended
B
Lift into retained AzureSA North region · single-cloud consolidation
One cloud to govern · R25k absorption applies · but: VM+SQL costs exceed the cluster fee, ZAR-adjusted pricing, billing anomaly must be resolved first
≈ R15–19k/mo
est., usage-metered
Viable
C
Stay on AWS — renew commitmentalready af-south-1 · harden in place
Renewal roulette continues (F-07) · posture fixes F-23–F-27 remain your own labour · custody model unchanged
≈ R11–13k/mo
est. + renewal risk
Partial fix
D
Local SA VPS / colocationcommodity hosting provider
Cheap rent · but DIY ops: no clinical SLA, no patch cadence, no IR runbook — recreates F-06/F-07 with a different logo
≈ R6–9k/mo
excl. ops labour
Not advised
E
SOVEREIGN hybridIonity cluster + encrypted Azure DR replica
Everything in A, plus funder-grade RPO/RTO evidence and dual-site continuity — the natural Phase-2/DOME end-state
R11,900/mo
+ R186k once
Upgrade path

Phase 1 mandate: list the options, price them honestly, and leave the direction with the client (§2.4). Estimates B–D from current SA public price cards at typical sizing; firm quotes on request. A and E are firm Ionity offers valid 90 days.

The honesty slide

What could go wrong — and what's already in place for it.

“On-prem means we carry the fire risk.”

True — mitigated by 3-2-1 backups with an off-site encrypted copy (SOVEREIGN adds a live Azure DR replica), dual UPS, surge protection, and restore drills evidenced monthly. The written DR test replaces AWS's implicit promise with your explicit proof.

“What if Ionity is unavailable?”

Hardware is yours; configs, runbooks and credentials live in your vault, documented to hand-over standard. Any competent engineer can operate the cluster — the anti-F-08 design. Escrowed documentation is a contract term, not a favour.

“Load-shedding and connectivity.”

5V/20W-class nodes ride UPS for hours, not minutes; LTE failover keeps sync and monitoring alive; the estate's own offline-first design (vehicles sync when they can) is preserved — it was built for this country.

“Micro-computers sound small.”

Sized against measured load: the current workloads idle a fraction of one modern ARM64 node. Eight nodes give headroom, HA and growth; DOME-era scale simply adds nodes — R12k a step, not a re-platform.

Net risk position

The exit trades provider risks you can't control (pricing cliffs, FX, jurisdiction, custody) for operational risks you can engineer away — and the engineering is included in the fee. That trade is the audit's central recommendation.

IV
Act Four

Systems Detail — every remedy on record.

The per-system findings and remedies from both tracks, condensed from fourteen profile documents — with the finance consolidation and CHOMI's AI path called out.

Internal trackSage · Fusion · S-Cube · SSRS · Salesforce
Client-facing trackSMART 2.0 · SNowI · CHOMI · iShout · MojaMind
Finance focusOne backbone, staged safely
AI governanceChomi v2 on guardrails
Internal track

The back office: fragmented today, consolidated tomorrow.

System
What we found
Remedy
Sage Evolution V9 finance core · ~R70k/yr · 7 usersend-of-life path
V9 unsuited to dynamic grant reporting; outsourced VM hosting causes speed/connectivity friction; finance landscape fragmented across five tools.
Consolidate: Dynamics 365 (NGO ~60% discount, ~R20k/yr · 4 users) vs the Sage route — Sage X3 preferred (logistics included; avoids a repeat migration): Sage 300 is being phased out within ~3 years (Exco 22 Jul); 3/6/9-month staged cut-over.
Fusion (Neurasoft) procurement / DoA · R24k/yrcoupled decision
Enforces the Delegation-of-Authority spend control — but does not integrate with Sage Intacct; its future is chained to the Sage choice (F-FU-COUPLE).
Decide as one branch of the finance decision; preserve DoA enforcement through any change; review approver matrix currency.
S-Cube / BioSyn payroll & T&ASPOF
Payroll dependent on one person; T&A integration pending; funder-critical process partly manual.
Retain & integrate; cross-training underway removes the single point of failure; confirm the BioSyn API path.
SSRS reporting · Afrihost · R36k/yraccess model
Shared credentials on reports drawn from clinical sources; no data classification recorded on a server that inherits its sources' sensitivity.
Fold into RPT-1 on the intranet cluster: individual Azure AD-tied accounts, access logging, classification inherited from SMART 2.0.
Salesforce lead capture onlyfold in
Used for a sliver of its licence; incomplete field usage blocks reporting value.
Replace / replicate internally within the consolidated stack — no standalone licence for a form.
FreshService helpdesk · R10k/yrkeep
Stable, low-cost, three-field API = low lock-in; renewal date unconfirmed; Chomi tickets can carry GBV-adjacent PII.
Keep; confirm renewal deliberately; align the Chomi ticket flow with POPIA treatment.
Client-facing track

Reach the beneficiary — without the vendor lock-in.

Platform
What we found
Remedy
SMART 2.0 clinical hub · ~R350k/yr all-incritical · lock-in
One external developer at high cost, no completed handover (F-02); maintenance dark ~18 months; Single-AZ clinical RDS (F-27); fingerprint verify bypassed under load.
Code review → escrow → handover; migrate to intranet APP/DB nodes; restore biometric capacity; maintenance under CLINICAL cadence.
SNowI 2 follow-up CRM · Shout-ownedownership risk
Built by a departed internal developer; no recorded support model; rides SMART 2.0's AWS environment.
Secure ownership & document before change; co-migrate with the hub; WhatsApp-primary direction preserved.
CHOMI / AIMEE GBV bot · R54k/yr · BotPresssensitive
Departed external developer; language-count discrepancy (4 vs 7); anonymous-by-design but adjacent ticket flow carries PII.
Secure credentials; advance Chomi v2 (AI-enabled, Option C hybrid) with governance guardrails — next pages.
iShout + eLearning AGYW app · R96k/yr + built-dormanthandover
Softdeck/Softlink handover completed — code stable under Peter, no vendor fees currently paid (Exco 22 Jul); DataFree disabled undercuts the app's purpose; eLearning complete but unused; ShoutLink dormant ~1 year.
Consolidate under managed cadence; re-enable DataFree; activate eLearning inside iShout; confirm ShoutLink functions absorbed into SMART 2.0 web.
MojaMind e-art mental health · pre-go-livemost sensitive data
HIV status + mental-health data + potential minors — the estate's most sensitive combination; go-live already slipped; new supplier needed post-launch.
Gate go-live on POPIA basis, ethics & crisis-path readiness; land in retained Azure (R25k barrier); delay contractor handover until the 8–10-week intervention completes.
Finance — the single biggest structural lever

One finance backbone — funder-ready, not fragmented.

Finance lives across Sage, Fusion, CaseWare, S-Cubed and an in-development BioSyn build. The remedy is deliberate consolidation with a safe, staged phase-out — no rip-and-replace — prioritising Sage X3 on the Sage side (Sage 300 is being phased out within ~3 years — Exco 22 Jul), weighed honestly against Dynamics 365 NGO pricing.

Evaluate Dynamics 365 + Sage Stack

NGO sector discount up to ~60% — indicative ~R20k/yr for 4 users vs the Sage V9 estate at R70k + add-ons. Fresh NPO-focused demo agreed; weighed honestly against the Sage route — now led by Sage X3 (logistics functionality included; no repeat migration when Sage 300 sunsets).

Retain what works

Keep S-Cube for payroll & T&A — integrate rather than replace; confirm the BioSyn API; keep Fusion's DoA control intact through any change (the Intacct constraint decides its path).

Phase out safely

A 3 / 6 / 9-month staged hand-over retires legacy finance and the on-prem server load without ever interrupting payroll or funder reporting. The asset register (ex-Snipe-IT) arrives as part of the move.

Why it matters financially

Sage Evolution V9 is on borrowed time — replacement is a priority, not a nice-to-have. Consolidation is the largest structural lever on the ~R620k spend: ≈ R50k/yr net licence gain, plus the un-priced but real savings of one reconciliation instead of five (audit fees, close time, error risk — SARS and grant reporting included). Recommendation emphasis (updated at Exco, 22 Jul): Sage X3 is the preferred Sage option — Sage 300's ~3-year phase-out would force a second migration; X3 lands once, logistics included.

Sage X3 — the capability paths that retire Sage 300

Sage X3 — one funder-grade ERP backbone.

These are the operating paths delivered on Sage X3 — the chosen Sage route, with Sage 300 ruled out for its ~3-year phase-out. Each path lands once on that same Sage lineage, logistics and donor reporting included, feeding the consolidated core.

Financial Management & Donor Accountability

Grant & Donor Tracking

Streamlines tracking for multi-funder revenue streams (e.g. Gates Foundation, Gilead Sciences), keeping funds segmented and fully audit-ready.

Automated Financial Reporting

Generates real-time financial statements, budget-vs-actual reports and regulatory compliance records for board and donor reviews.

Multi-Currency & Tax Handling

Manages multi-currency grant allocations and local SA tax regulations (VAT, NPO compliance) within a centralised ledger.

Supply Chain & Inventory Management

Pharmaceutical & Medical Supply Tracking

Tracks stock levels of health supplies across mobile-clinic fleets — HIV test kits, PrEP, contraceptives and field equipment.

Batch & Expiry Management

Lot-tracking and expiry monitoring to prevent medical waste and ensure compliant delivery of healthcare commodities.

Procurement Optimisation

Centralises purchase orders, vendor contracts and automated reorder points — continuous field supply without overstocking.

Operational & Fleet Logistics

Mobile Unit & Fleet Asset Management

Tracks capital equipment, maintenance schedules and operating costs for mobile clinics operating across multiple districts.

Centralised Master Data

Connects administrative operations across headquarters, regional hubs and field operations under a single database.

All paths run on Sage X3 with that Sage lineage retained — not a new platform, logistics included, and no repeat migration when Sage 300 sunsets.

Sage X3 — integration, intelligence & funder compliance

Sage X3 — connected, intelligent, funder-ready.

The Sage X3 paths that wire the ERP into Shout-It-Now's field systems, the national health estate and live funder reporting.

System Integration & Business Intelligence

Data Integration Capabilities

Connects backend ERP operations via APIs with Shout-It-Now's custom field systems (e.g. SNowI 2, SMART 2.0) for streamlined record-keeping.

Real-Time Analytics & Dashboards

Converts financial, operational and supply metrics into customised dashboards for strategic executive decision-making.

Scalable Architecture

Supports expansion as Shout-It-Now scales its reach, mobile fleet and regional footprint across South Africa.

Integration, Data & Donor Compliance

National Health System Interoperability

Uses open health standards (FHIR APIs) to seamlessly link field data with the SA Department of Health (NDoH) and Tier.Net systems.

Real-Time PEPFAR / Funder Reporting

Eliminates manual data aggregation, generating real-time indicator reports for donors (e.g. USAID, CDC, Gates Foundation).

ERP & Inventory Integration

Feeds consumption and dispensing data directly into back-office ERP (Sage X3) to automate stock reordering for test kits, medication and clinical consumables.

Sage X3 sits inside the consolidated core — the finance and supply spine feeding Power BI, the DOME clinical layer and governed AI.

AI & model governance — Pillar 8

Chomi grows up — with guardrails, not vibes.

Chomi v2 — AI-enabled, Option C hybrid

Advance the GBV companion on the existing BotPress backbone: WhatsApp-first plus a light PWA. Nine content streams, 640+ messages per language, four (target seven) languages — now with AI-assisted conversation depth while keeping the social-work team's best-practice framing: empathy → facts → options.

A survivor's chat is the most sensitive conversation this organisation hosts. v2 is therefore an engineering-governance project, not a chatbot refresh.

The governance frame — applied

  • Model provenance & hosting jurisdiction declared — local/edge inference preferred (AI-M path)
  • Prompt-injection & PII-leakage controls; anonymous-by-design preserved
  • Human-in-the-loop escalation to live services — the “Help Now” path is sacred
  • Conversation logging with retention rules (C3/C8) — evidence without surveillance
  • Reconcile the 4-vs-7 language record before scope-pricing v2

The same frame governs Self Cav / AIMEE and the NACOSA-prioritised AI reporting agent — every AI touchpoint in the estate answers the same eight questions before it ships.

Remedy for F-29 · shorten the sprawl · host the AI locally

From a scripted maze offshore
to one local model + RAG on SA soil.

Today · Botpress (offshore)
WhatsApp user (survivor) Botpress cloud · scripted tree9 streams × 640+ msgs × 4–7 languages ≈ thousands of hand-built nodes Offshore LLMper-call USD · cross-border hop #2 FreshService ticketname + cell + location — re-identifies border ✗ border ✗
Chomi v2 · Ionity edge (SA soil)
WhatsApp user (survivor) Ionity edge · local LLM (AI-M 5V/20W)empathy → facts → options, as a system prompt RAG retrieverthe 640+ vetted messages = knowledge base “Help Now” → human escalationinternal referral · logs stay on-prem ✓ in-country
1
corpus + 1 local model replaces thousands of scripted nodes
1→∞
languages handled by the model — no more 640 msgs per language
0
border crossings — F-29 closed by architecture
R0
marginal LLM cost — local inference, no per-call USD
edit
a document to update — not rebuild a decision tree

How it shortens: the hundreds of hand-built menus and 640+ messages per language become a single retrieval corpus the local model reads at answer-time. Same trauma-informed framing, same “Help Now” path — but no Botpress subscription, no offshore LLM, no cross-border transfer, and maintenance becomes “drop a document in the corpus.” It rides the same Ionity edge node as the clinical exit — one architecture, two problems solved.

Flow reconstructed from the CHOMI system profile (9 streams · 640+ messages/language · menu tree) and the 19 Jun platform-decision note. The Miro “Chomi” board maps the current scripted tree — the corpus this RAG build ingests wholesale, losing nothing.

V
Act Five

The Road Ahead — three phases, one governed AI build.

Delivered
Phase 1

Audit & Advisory

complete — this presentation closes it
  • 21-system baseline & coverage map
  • Findings register F-01→F-27, POPIA-mapped
  • Costed gains ledger & savings case
  • AWS-exit recommendation with alternatives
Decision now
Phase 2

Migrate & Consolidate

weeks 1–8 post sign-off
  • Ionity intranet cluster build & parallel-run migration
  • Azure-bound moves under the R25k barrier
  • DOME consolidation & QMS / security documentation
  • Chomi v2 (AI-enabled) scoped build
Then
Phase 3

Rationalise & Cut

months 3–9
  • Finance cut-over completes (3/6/9 hand-over)
  • Decommission dormant & duplicate systems
  • Vendor-dependency reduction on the clinical core
  • Run-rate lands ≈ R285–320k/yr

Parallel build — AI Reporting Agent

Grant-driven dashboard agent — NACOSA prioritised ahead of Enterprise & Gilead. Data mapping first; phased, scoped quotation follows.

The first 90 days — owners named, fruit picked

Ninety days to a different estate.

Days 1–30 banks R0 · cuts risk

  • Enforce MFA on all 6 IAM users; disable 4 dormant + the int32 vendor account; delete 3 stale access keys (Neetin)
  • Email-security true-up across ~200 mailboxes; MFA enforced (IT)
  • Sign the AWS-exit decision before the Sep-26 window becomes a deadline (Board)
  • Regularise the Azure billing anomaly with Microsoft (Finance + IT)

    • Days 31–60 banks ≈ R132k/yr

  • Snipe-IT: recover access → register into finance → decommission (IT + Pierre)
  • Data Warehouse: retire; Power BI direct source links for M&E (IT + M&E)
  • Cluster stand-up & shadow replication begins (Ionity)
  • Dynamics 365 NPO demo → finance decision table signed (Pierre + Lilian)

    • Days 61–90 banks ≈ R117k/yr more

  • Cut-over weekend: AWS → Ionity intranet; clinics open Monday unchanged (Ionity + IT)
  • MojaMind lands in retained Azure inside the R25k barrier (Ionity)
  • AWS accounts decommissioned; snapshots archived to BAK-1 (Ionity)
  • First monthly patch + restore drill evidenced — the new normal (Ionity)

    • Owner initials per the engagement stakeholder map — Corporate Services (L. Monji), IT Operations (N. Daya), Finance (P. van Papendorp), Ionity delivery (J. van Antwerp, I. Raven).

    Compliance & standards — where the plan lands you

    POPIA answered. ISO 27001 within reach.

    POPIA — condition by condition

    C7 Security
    now
    plan
    §72 Transfer
    now
    plan
    C3 · C8 Data life
    now
    plan
    §22 Notification
    now
    plan

    “Plan” = quick wins + migration + MON-1 logging & IR runbook delivered. §72 already GREEN — residency confirmed af-south-1 (F-17, 30 Jun 2026); the plan clears the residuals (SNowI 2 store · eu-west-1 test box) to 100%.

    ISO/IEC 27001 — the stated objective

    The roadmap is sequenced against Annex A control families: asset inventory (fixed by the register), access control (identity lifecycle + individual logins), ops security (patch cadence), supplier relationships (custody & escrow), incident management (runbook + evidence). Phase-2 QMS documentation makes the readiness programme formal. NIST CSF 2.0 was tabled at Exco (22 Jul) as a candidate governance frame — the chosen path follows the migration route selected.

    Funders — PEPFAR · Global Fund · HPCSA

    Evidence-first posture: restore drills, access logs, residency attestation and DR metrics become artefacts you can hand over, not claims you make. The SOVEREIGN tier adds evidenced RPO/RTO if funder requirements harden.

    What we need from you

    Five decisions unlock everything.

    #DecisionBy
    D-1AWS exit — approve Option A (Ionity intranet, CLINICAL tier) or select an alternative from the matrixbefore Aug-26
    D-2Finance backbone — Dynamics 365 (NGO) vs Sage X3 (Sage 300 ruled out at Exco — ~3-yr phase-out; logistics included in X3) after the fresh NPO demo30 days
    D-3Quick-win mandate — Snipe-IT & Data Warehouse decommission, credential rotation, mailbox true-upimmediate
    D-4Phase-2 scope sign-off — migration + DOME + Chomi v2 quotationat sign-off
    D-5Green-light the NACOSA AI reporting agent scopingoptional

    The arithmetic of waiting

    Every month of delay costs ≈ R11k in dormant spend alone — and each month closer to September narrows the calm window for a zero-downtime migration. Decided this month, the estate is off AWS with six weeks of margin before the commitment expires.

    The audit is self-funding: the fruit pays for the tree.

    Annex · the reference library

    Evidence Annex — curated client view.

    The complete non-secret audit record is the 485-file SHOUTITNOW-AUDIT-REPO beside this file. This Annex is a directly linked client selection — opening with the SOP · Implementation & Alternatives pack (roadmap documents + all decision graphics) — including the final-workspace supplements and their SHA-256 provenance. Credential files remain held separately (secrets — excluded by design).

    SOP · Implementation & AlternativesHow-to: the signed roadmap (ION-IR-2026-001), the SOP change loop, the five alternative pathways per §2.4, and every decision graph.6 files · 9 graphs
    ION-IR-2026-001 Implementation Roadmap — v4.0 FINALPDF · 2.0 MBION-IR-2026-001 Implementation Roadmap — v4.0 FINAL (editable)DOCX · 2.1 MBION-IR-2026-001 Implementation Roadmap — v3.1 (prior)PDF · 1.8 MBFull_Systems_Alternatives_Review (1).docxDOCX · 24 KBSystem Alternative.DOC.docxDOCX · 385 KBSystem_Assessment_Updated_Apr2026.xlsxXLSX · 34 KB
    Standard Operating Procedure — change and compliance cycle, 8-step loopSOP — Change & Compliance CycleIntake → assess → approve → implement → log → audit → report → learn. Every change auditable, owned.Five pathways for the AWS workloads — alternatives A to E, the client decidesAlternatives — Five Pathways (§2.4)A Ionity intranet (rec) · B Azure lift · C harden AWS · D local VPS · E sovereign hybrid — client decides.Migration roadmap AWS to Azure in about two months — decision flowchartHow-to — Migration Flow (±2 months)Exco approval → Phase 1 build → validate → Phase 2 parallel run → checks green → Phase 3 decommission.Implementation timeline Gantt chart, August to December 2026Implementation Timeline — Aug→Dec 2026Workstreams A–G with the AWS commitment cliff (~Sept, F-04) marked in red.Target architecture — Shout-It-Now on Azure, 21 systems consolidatedTarget Architecture — 21 SystemsChannels → AI decision layer → Fabric lakehouse → applications → Azure foundation + DOME-Network.Consolidation destiny map — every system routed to Azure, Sage X3, Ionity intranet or retirementConsolidation Destiny MapEvery chip routed: Ionity intranet · retained Azure · Sage X3 backbone · retire/stop-paying.Baseline annual system cost — grand total R 1 244 000 per yearBaseline Cost — R 1 244 000/yrPer-system annual spend from the own workbook (27/03/2026); SMART 2 R458k dominates.Ionity managed hosting — clinical tier topology and three hosting tiersIonity Managed Hosting — TiersCore · Clinical (★ recommended) · Sovereign — no usage metering, no egress fees, no cliffs.IT audit review relations map — costs, migration, governance, findings, next stepsAudit Relations Map — ION-MR-2026-004Costs · migration · governance · findings & risks · next steps on one canvas (22 Jul 2026).
    Final Reports & Sign-offPhase 1 v3, ENDHANDIN, SPINE, AI architecture, sign-off, change plan.9 files
    A1C-REPORTShout-It-Now__AUDIT_ENDHANDIN-1-20-July-2026_2 (1) (1).docxDOCX · 9.5 MBCopy of SmartSuite_Recommendation_Ionity.docxDOCX · 375 KBSIN_Change_Management_Plan_v1.docxDOCX · 198 KBShout IT Now AI Platform Technical Architecture Report.docxDOCX · 783 KBShout-It-Now_Final_Report_Phase1_v3.docxDOCX · 2.1 MBShout-It-Now_Final_Report_SPINE_v0.2_Ionity.docxDOCX · 382 KBShout-It-Now_IT-Audit_Report-01.docxDOCX · 27 KBShout-It-Now_Progress_Sign-Off_Sheet_V1.0.docxDOCX · 194 KBSmartSuite_Recommendation_Ionity.docxDOCX · 374 KB
    Finance Internal AuditA1P1F finance audit (docx+pdf), HR↔Finance integration, Sage 300 overview.8 files
    A1P1F-REPORTShout-It-Now_Finance-Internal_AUDIT_Week-17-23-Jun-2026_2 (1) (1).docxDOCX · 9.3 MBA1P1F-REPORTShout-It-Now_Finance-Internal_AUDIT_Week-17-23-Jun-2026_2 (1).docx.pdfPDF · 7.4 MBA1P1F-REPORTShout-It-Now_Finance-Internal_AUDIT_Week-17-23-Jun-2026_2(1).docxDOCX · 7.8 MBA1P1F-REPORTShout-It-Now_Finance-Internal_AUDIT_Week-17-23-Jun-2026_2.docxDOCX · 336 KBA1P1F-REPORTShout-It-Now_Finance-Internal_AUDIT_Week-17-23-Jun-2026_2.pdfPDF · 7.3 MBIONITY_Sage300People_Director_Overview.docxDOCX · 1.7 MBIONITY_Sage300People_Director_Overview.pdfPDF · 1.4 MBIntegration of HR and Finance Systems.pdfPDF · 204 KB
    System ProfilesPer-system assessments — 13 systems.13 files
    CHOMI_System_Profile.docxDOCX · 19 KBData_Warehouse_System_Profile.docxDOCX · 12 KBF-28_Azure_SnipeIT.docxDOCX · 18 KBFreshService_System_Profile.docxDOCX · 12 KBFusion_System_Profile.docxDOCX · 12 KBMicrosoft365_System_Profile.docxDOCX · 12 KBMojaMind_System_Profile.docxDOCX · 13 KBSMART2_System_Profile.docxDOCX · 13 KBSNowi_System_Profile.docxDOCX · 12 KBSSRS_System_Profile.docxDOCX · 11 KBSage_Evolution_System_Profile.docxDOCX · 12 KBeLearning_System_Profile.docxDOCX · 19 KBiShout_System_Profile.docxDOCX · 13 KB
    Assessment & AlternativesSystem Assessment workbook + alternatives + eLearning plan.8 files
    Copy of System_Assessment_Updated_Apr2026 (2).xlsxXLSX · 34 KBFull Systems Alternatives .DOC.docxDOCX · 29 KBFull_Systems_Alternatives_Review (1).docxDOCX · 24 KBSystem Alternative.DOC.docxDOCX · 385 KBSystem_Assessment_Updated_Apr2026 (2).xlsxXLSX · 34 KBSystem_Assessment_Updated_Apr2026.xlsxXLSX · 26 KBSystem_Assessment_Updated_Apr2026v2.xlsxXLSX · 19 KBeLearning Project Plan.xlsxXLSX · 14 KB
    Website AuditSIN-WEB-2026-R01 v1.4 (docx + pdf).2 files
    Shout-It-Now_Website-Audit_SIN-WEB-2026-R01_v1.4.docxDOCX · 1.5 MBShout-It-Now_Website-Audit_SIN-WEB-2026-R01_v1.4.pdfPDF · 697 KB
    Quotations, Scope & EngagementION-QUO-001/002, SOW, scope/methodology, Q004/Q021, tracker.18 files
    2026_S^F1_Ai_compliance (1).docxDOCX · 284 KBION-QUO-SHOUT-2026-001_Quotation_MULTI (3).pdfPDF · 1.7 MBION-QUO-SHOUT-2026-001_Quotation_v4 (1).docxDOCX · 2.5 MBION-QUO-SHOUT-2026-001_Quotation_v4 (3).docxDOCX · 2.5 MBION-QUO-SHOUT-2026-001_Quotation_v5.pdfPDF · 2.8 MBION-QUO-SHOUT-2026-002_Quotation_MULTI_v3 (1).docxDOCX · 1.2 MBIT_Audit_Four_Major_Points-k.docxDOCX · 556 KBIT_Audit_Methodology_Reference_Ionity-Global (1) (5).pdfPDF · 565 KBIT_Audit_Scope_Reference.docxDOCX · 553 KBIT_Audit_Scope_Reference_1.pdfPDF · 175 KBQ004-SHOUT001-Audit001.pdfPDF · 4.5 MBQ021-SN01-AD1-26D.pdfPDF · 7.0 MBQTE-Audit-Questions (2).pdfPDF · 2.5 MBREF_SOW-Original-AUDIT-Phase1.mdMD · 5 KBSCOPE OF WORK_ IT SYSTEM ASSESSMENT_ April 2026 (2).docxDOCX · 19 KBSHOUTIT-NOW_Phase-1_Quotation.docxDOCX · 1.9 MBShoutItNow_ProjectTracker.xlsxXLSX · 19 KBShoutItNow_SOW (1).docxDOCX · 11 KB
    Meeting Reports (ION-MMR) & SummariesION-MMR-01→21 + 8 Word summaries + consolidated.30 files
    01_project_status_checkin_24jun.docxDOCX · 217 KB02_sage300_demo_shoutitnow_22jun.docxDOCX · 219 KB03_sage300_demo_ionity_22jun.docxDOCX · 217 KB04_chomi_proposal_review_22jun.docxDOCX · 218 KB05_womens_health_platform_decision_19jun.docxDOCX · 217 KB06_tech_handover_19jun.docxDOCX · 217 KB07_womens_health_app_scoping_18jun.docxDOCX · 217 KB08_shout_it_assessment_kickoff_17jun.docxDOCX · 217 KBION-MMR-2026-01_Client-Feedback-Meeting.docxDOCX · 11 KBION-MMR-2026-02_Pre-Kickoff-IT-Landscape-Induction.docxDOCX · 12 KBION-MMR-2026-03_Kick-Off-Phase-1-IONET-Assessment.docxDOCX · 12 KBION-MMR-2026-04_Neetin-IT-Audit-Kickoff-Access-Quotation.docxDOCX · 11 KBION-MMR-2026-05_Women-s-Health-App-Scoping-WhatsApp.docxDOCX · 11 KBION-MMR-2026-06_Platform-Decision-Chomi-Botpress.docxDOCX · 11 KBION-MMR-2026-07_Tech-Handover-Code-Access-Credentials.docxDOCX · 11 KBION-MMR-2026-08_GBV-Workflow-15-37.docxDOCX · 11 KBION-MMR-2026-09_Finance-Audit-ENDPOINTS.docxDOCX · 11 KBION-MMR-2026-10_Chomi-WhatsApp-Proposal-Review.docxDOCX · 11 KBION-MMR-2026-11_Sage-300-People-Demo-Ionity-view.docxDOCX · 11 KBION-MMR-2026-12_Sage-300-People-Demo-Shout-It.docxDOCX · 11 KBION-MMR-2026-13_Project-Status-Check-In-Website-Report.docxDOCX · 11 KBION-MMR-2026-14_HR-Payroll-Systems-Discovery-IT-Review.docxDOCX · 11 KBION-MMR-2026-15_Finance-Systems-Audit-Sage-vs-Dynamics.docxDOCX · 11 KBION-MMR-2026-16_IT-Systems-Audit-Progress-Findings-Recommendations.docxDOCX · 11 KBION-MMR-2026-17_Finance-Meeting-3-Dynamics-365.docxDOCX · 11 KBION-MMR-2026-18_AI-Dashboard-Solution-Scoping-NACOSA-Enterprise.docxDOCX · 11 KBION-MMR-2026-19_Week-Plan.docxDOCX · 11 KBION-MMR-2026-20_Check-in-online.docxDOCX · 11 KBION-MMR-2026-21_IRP-Engineering-Plastics-in-person.docxDOCX · 11 KBIonity_Meeting_Report_ShoutItNow_CONSOLIDATED_2026-07-01.docxDOCX · 28 KB
    Meeting Notes (dated)Raw + Gemini transcript notes, Jun–Jul 2026.42 files
    2026-06-02_Client-Feedback-Meeting.mdMD · 7 KB2026-06-12_Pre-Kickoff_Gemini.mdMD · 95 KB2026-06-12_Shout-It-Now_Pre-meeting.mdMD · 6 KB2026-06-15-17_IT-Systems-Review-Summary.mdMD · 5 KB2026-06-15_IONET-Assessment-Kickoff_Summary.mdMD · 3 KB2026-06-15_IT-Systems-Meeting-Notes.mdMD · 62 KB2026-06-15_Kick-Off_Notes-short.mdMD · 1 KB2026-06-15_Kick-Off_Phase1_Gemini.mdMD · 51 KB2026-06-17_08_assessment-kickoff.mdMD · 3 KB2026-06-17_Neetin-IT-Meeting_Gemini.mdMD · 60 KB2026-06-17_Neetin-IT-Meeting_Notes-short.mdMD · 0 KB2026-06-17_Phase1-IT-Audit-Kickoff-Neetin_Access-Quotation-SLA.mdMD · 39 KB2026-06-18_07_womens-health-app-scoping.mdMD · 2 KB2026-06-18_Womens-Health-App-Scoping_WhatsApp-vs-App.mdMD · 16 KB2026-06-19_05_womens-health-platform-decision.mdMD · 3 KB2026-06-19_06_tech-handover.mdMD · 2 KB2026-06-19_Finance-Audit-ENDPOINTS_Gemini.mdMD · 2 KB2026-06-19_Finance-Audit-ENDPOINTS_Notes-short.mdMD · 1 KB2026-06-19_Meeting-1537_Gemini.mdMD · 33 KB2026-06-19_Platform-Decision_Chomi-Botpress.mdMD · 23 KB2026-06-19_Tech-Handover_Code-Access-Credentials.mdMD · 23 KB2026-06-19_Tech-Handover_Meeting-Summary-8pt.mdMD · 5 KB2026-06-22_02_sage300-demo-shoutitnow.mdMD · 6 KB2026-06-22_03_sage300-demo-ionity.mdMD · 3 KB2026-06-22_04_chomi-proposal-review.mdMD · 4 KB2026-06-22_Chomi-WhatsApp-Proposal-Review-Neetin.mdMD · 37 KB2026-06-22_Sage300-Demo-ShoutItNow-NPO.mdMD · 4 KB2026-06-22_Sage300-People-Demo-for-Ionity.mdMD · 8 KB2026-06-22_Sage300-People-Demo_ESS-Payroll-Reporting.mdMD · 52 KB2026-06-22_Sage300-People-Demo_QA-OCR-Biosyn-API.mdMD · 3 KB2026-06-24_01_project-status-checkin.mdMD · 3 KB2026-06-24_HR-Payroll-Systems-Discovery-IT-Review.mdMD · 27 KB2026-06-24_Progress-Report_Phase1-IT-Audit.mdMD · 6 KB2026-06-24_Project-Status-CheckIn_Website-Report-Infra.mdMD · 14 KB2026-06-25_Finance-Systems-Audit_Sage-vs-Dynamics_Summary.mdMD · 1 KB2026-06-26_Finance-Meeting-3_Audit_Dynamics365.mdMD · 2 KB2026-06-26_IT-Systems-Audit-Progress_Findings-Recommendations_Summary.mdMD · 1 KB2026-06-29_AI-Dashboard-Scoping_Meeting-Note-Template.mdMD · 5 KB2026-06-29_AI-Dashboard-Scoping_Meeting-Report-v1.mdMD · 4 KB2026-06-29_AI-Dashboard-Scoping_NACOSA-Enterprise-Gilead_Summary.mdMD · 1 KB2026-06-29_Week-Plan_Gemini.mdMD · 27 KB2026-06-30_Check-in_Gemini.mdMD · 51 KB
    Notion Records & SummariesHub cards, master summary, full inventory, CSVs.14 files
    EVENTS_Notice-Board.mdMD · 4 KBHUB_SUMMARY_Ionity-branded-meeting-summaries.mdMD · 1 KBINVOICE_Shout-It-Now.mdMD · 1 KBMeeting-Ops_Minutes-and-Followups.mdMD · 19 KBREF_About-Shout-It-Now.mdMD · 4 KBREF_IT-Audit-Scope-Reference_Coverage-Map.mdMD · 5 KBREF_Ionity-Shout-Flow-Proposal.mdMD · 1 KBREF_Shout-Flow-Live-Document-v1.mdMD · 2 KBShout-It-Now — Master Summary (Consolidated 2026-07-01).docxDOCX · 11 KB_ALL-MEETINGS_8POINT.mdMD · 21 KB_FULL-INVENTORY.mdMD · 8 KB_MASTER-SUMMARY.mdMD · 7 KBshoutitnow-impact-summary.csvCSV · 0 KBshoutitnow-inventory.csvCSV · 2 KB
    Vendor & Product DocsMimecast/Xcally quotes, DW proposal, product guides.8 files
    Creative Resilience Demo_08042025.pptxPPTX · 13.3 MBQuote-CS-FTLJMKG1YWSF_ Mimecast.pdfPDF · 402 KBSNowi Tech.pptxPPTX · 78 KBSNowi User Guide - V3.0.6 (1).pptxPPTX · 13.8 MBShout it Now - Xcally for Business V1 Signed Proposal.pdfPDF · 249 KBShout it now datawarehouse proposal v3.0.pdfPDF · 613 KBShout.Chomi overview.Feb2024.pdfPDF · 1.5 MBiSHOUT! overview2022.pptxPPTX · 5.4 MB
    FLOW — Women's HealthShout Flow operational research protocol.1 files
    Operational Research Protocol_The Shout Flow Model for Longitudinal Menstrual Health Studies 17 June 2026v2 (1).docxDOCX · 727 KB
    SMART 2.0, AWS & CHOMI EvidenceClinical user guide + live AWS console (cost/IAM/regions) + CHOMI Botpress analytics.6 files
    240227 SMART 2.0_Clinial Management User Guide.pdfPDF · 11.1 MBAWS_Console_Evidence_2026-07-20.mdMD · 0 KBAWS_Cost_and_Usage_SMART2_Jan-Jun-2026.csvCSV · 1 KBAWS_IAM_Users_2026-07-20.csvCSV · 0 KBCHOMI_Botpress_Analytics_2026-07-20.csvCSV · 1 KBCHOMI_Botpress_POPIA_Note_2026-07-20.mdMD · 2 KB
    Ionity TemplateOfficial 2026 document template.1 files
    TEMPLATE_2026_OFFICAL_v1.1 (3) (1).docxDOCX · 367 KB
    Working Library — On-Demand Source FilesLate-added working files served from this site: Mimecast report, Final Report v1.0, and the roadmap & finance page scans.3 files · 14 scans
    Mimecast — Shout-It-Now ReportDOCX · 1.1 MBFinal Report Phase 1 — FINAL v1.0DOCX · 30 KBION-IR-2026-001 Roadmap — v3.1 (editable)DOCX · 2.0 MBRoadmap scan — p.01 (cover)JPGRoadmap scan — p.05JPGRoadmap scan — p.07JPGRoadmap scan — p.08JPGRoadmap scan — p.09JPGRoadmap scan — p.11JPGRoadmap scan B — p.05JPGRoadmap scan B — p.06JPGRoadmap scan B — p.07JPGRoadmap scan B — p.09JPGRoadmap scan B — p.11JPGRoadmap scan S — p.09JPGFinance scan — p.07JPGFinance scan — p.09JPG
    Final-Workspace SupplementsSHA-256 traced AI governance, CHOMI issue, and alternatives records.6 files
    IMPORT-MANIFEST.mdMD · provenanceAI Governance Pack — July 2026DOCX · 284 KBAI Governance Pack — June 2026DOCX · 318 KBCHOMI issue logDOCX · 12 KBFull Systems AlternativesDOCX · 29 KBSystem AlternativeDOCX · 385 KB

    Meetings — the engagement record (Jun–Jul 2026)

    2026-06-02Client Feedback MeetingNote ↗
    2026-06-12Pre Kickoff GeminiNote ↗
    2026-06-12Shout It Now Pre meetingNote ↗
    2026-06-1517 IT Systems Review SummaryNote ↗
    2026-06-15IONET Assessment Kickoff SummaryNote ↗
    2026-06-15IT Systems Meeting NotesNote ↗
    2026-06-15Kick Off Notes shortNote ↗
    2026-06-15Kick Off Phase1 GeminiNote ↗
    2026-06-1708 assessment kickoffNote ↗
    2026-06-17Neetin IT Meeting GeminiNote ↗
    2026-06-17Neetin IT Meeting Notes shortNote ↗
    2026-06-17Phase1 IT Audit Kickoff Neetin Access Quotation SLANote ↗
    2026-06-1807 womens health app scopingNote ↗
    2026-06-18Womens Health App Scoping WhatsApp vs AppNote ↗
    2026-06-1905 womens health platform decisionNote ↗
    2026-06-1906 tech handoverNote ↗
    2026-06-19Finance Audit ENDPOINTS GeminiNote ↗
    2026-06-19Finance Audit ENDPOINTS Notes shortNote ↗
    2026-06-19Meeting 1537 GeminiNote ↗
    2026-06-19Platform Decision Chomi BotpressNote ↗
    2026-06-19Tech Handover Code Access CredentialsNote ↗
    2026-06-19Tech Handover Meeting Summary 8ptNote ↗
    2026-06-2202 sage300 demo shoutitnowNote ↗
    2026-06-2203 sage300 demo ionityNote ↗
    2026-06-2204 chomi proposal reviewNote ↗
    2026-06-22Chomi WhatsApp Proposal Review NeetinNote ↗
    2026-06-22Sage300 Demo ShoutItNow NPONote ↗
    2026-06-22Sage300 People Demo for IonityNote ↗
    2026-06-22Sage300 People Demo ESS Payroll ReportingNote ↗
    2026-06-22Sage300 People Demo QA OCR Biosyn APINote ↗
    2026-06-2401 project status checkinNote ↗
    2026-06-24HR Payroll Systems Discovery IT ReviewNote ↗
    2026-06-24Progress Report Phase1 IT AuditNote ↗
    2026-06-24Project Status CheckIn Website Report InfraNote ↗
    2026-06-25Finance Systems Audit Sage vs Dynamics SummaryNote ↗
    2026-06-26Finance Meeting 3 Audit Dynamics365Note ↗
    2026-06-26IT Systems Audit Progress Findings Recommendations SummaryNote ↗
    2026-06-29AI Dashboard Scoping Meeting Note TemplateNote ↗
    2026-06-29AI Dashboard Scoping Meeting Report v1Note ↗
    2026-06-29AI Dashboard Scoping NACOSA Enterprise Gilead SummaryNote ↗
    2026-06-29Week Plan GeminiNote ↗
    2026-06-30Check in GeminiNote ↗

    Full catalogue incl. Notion & Google Drive originals: 09_Notion_and_Summaries/_FULL-INVENTORY.md. Repository under POL 986 AED · CONFIDENTIAL — CLIENT · curated 20 Jul 2026.

    Closing

    From findings to a
    lean, sovereign, funder-ready estate.

    Twenty-one systems audited. R335k+ a year identified. One cliff avoided. One cluster, drawn to the node, ready to build. Thank you to every person who opened their systems, shared their evidence and made time for the work.

    SHOUT-IT-NOWLilian Monji · Neetin Daya · Pierre van Papendorp · Angela · Ethan · Nathan · Motsabi · Judy · Dr Vuyi Skiti · Paul Potsane
    IONITY GLOBALJohan Wilhelm van Antwerp · Ian Jaco Raven · Dennis Grobler · Mike Kandolo · Robin Mary du Toit · William Njabulo Kodua
    SPECIALIST INPUTCandice · Zinti · Sage and implementation-partner teams
    Ionity Global (Pty) LtdBuilding Tomorrow, Today
    Contactinfo@ionity.today · +27 646 999 877
    Webwww.ionity.co.za · ionity.world
    Signature — Johan Wilhelm van Antwerp
    Johan Wilhelm van Antwerp
    Founder · Technical Lead & Architect
    Ionity Global (Pty) Ltd · AEDI
    The Ionity People Behind The Work
    Dennis Grobler business cardDennis GroblerTechnical · networking Ian Jaco Raven business cardIan Jaco RavenIndustrial engineer · partner Robin Mary du Toit business cardRobin Mary du ToitSystems administrator William Njabulo Kodua business cardWilliam Njabulo KoduaShareholder · partner
    “Anything is Possible with God.” · POL 986 AED · © 2026 Ionity Global (Pty) Ltd · TM
    Ionity — living brand card
    IONITY GLOBAL
    for
    VI
    Final Chapter

    DOME is the build direction for Phase 2.

    The audit establishes a DOME-network consolidation path: simplify the estate, preserve the systems that are working, retire avoidable sprawl, and move only through controlled approvals and evidence-backed acceptance.

    Consolidation coreDOME network target
    RetainAzure · S-Cube / BioSync
    RetireData Warehouse into DOME
    Exit conditionAWS after parallel-run acceptance
    One-page short version

    Final direction: build DOME through signed gates.

    The target is clear; the implementation remains disciplined. Retain Azure and S-Cube/BioSync, fold the Data Warehouse into the DOME direction, select the finance platform through the recorded evaluation, and exit AWS only after a verified parallel run.

    21 systemsone consolidated destiny map
    R 1 244 000 /yrbaseline annual system cost (Apr 2026 workbook)
    ±R285–320k /yrtarget estate run-rate (TOPEND forecast)
    ≤ Sept 2026AWS commitment cliff — R60–70k/mo if missed (F-04)

    Recommendation R-Short

    • Use DOME as the Phase 2 consolidation target with no net-new systems added outside the approved model.
    • Retain Azure for identity, productivity, reporting and integration services.
    • Retain S-Cube / BioSync while the finance consolidation path is formally selected.
    • Retire the Data Warehouse into the DOME reporting direction after direct reporting links are validated.
    • Exit AWS only after parallel-run validation, custody handover, and documented client acceptance.

    Execution order (concise)

    Step 1: Stabilise access, ownership and evidence.
    Step 2: Design DOME integration and reporting boundaries.
    Step 3: Select the finance consolidation route and migrate by approved workstream.
    Step 4: Exit AWS only after a verified parallel run and acceptance.

    Implementation window — Aug → Dec 2026

    Implementation timeline Gantt, Aug to Dec 2026, workstreams A–G

    Workstreams A Migration · B Remediation (F-register) · C ERP · D AI data platform · E DOME-Network · F Governance · G Products & funders. Dates are planning-level, confirmed sprint-by-sprint; the red line marks the AWS commitment expiry (~Sept, F-04).

    Target architecture (visual reference)

    Shout system architecture baseline visual
    DOME: target consolidation layer Keep: Azure Keep: S-Cube / BioSync Decide: finance platform Exit: AWS after acceptance

    Baseline architecture image included as provided. The decision overlay is intentionally specific only where the audit evidence is settled: DOME-centered consolidation, Azure and S-Cube/BioSync retained, the finance platform selected through its evaluation, and AWS removed only after parallel-run verification.

    Where the money sits today

    Baseline annual system cost per system, grand total R 1 244 000

    Baseline annual cost by system (own workbook, as at 27/03/2026): SMART 2 R458k dominates; internal R320k + external R924k = R 1 244 000/yr. Full chart set and roadmap documents are indexed in the Annex under SOP · Implementation & Alternatives.

    Phase 2 · start with the evidence, not assumptions

    DOME can start now. The gates keep it honest.

    The audit supplies the operating direction and a finite starting backlog. Each stream has a clear proof point before it becomes production work: no rip-and-replace, no new sprawl, and no AWS exit by assertion.

    Gate 01 · control

    Stabilise the estate

    Close access and ownership gaps, establish individual accountability, and preserve the evidence needed for POPIA, supplier and handover decisions.

    Proof: approved access register, ownership record and remediation evidence.

    Gate 02 · design

    Stand up the DOME spine

    Define the Azure identity, integration and reporting boundaries; validate direct reporting links before retiring the Data Warehouse into the target model.

    Proof: signed target architecture and reporting acceptance.

    Gate 03 · decide

    Select the finance route

    Complete the recorded Dynamics-versus-Sage evaluation, retain S-Cube/BioSync, and sequence the selected consolidation route through a staged handover.

    Proof: client decision, integration plan and cut-over schedule.

    AWS is an acceptance gate, not a calendar date

    Migrate the approved workloads in parallel, verify data and operational outcomes, complete custody handover, then obtain written client acceptance before any decommission. This keeps the audit's central risk reduction intact while preserving clinical continuity.

    What the client signs

    DOME target architecture · finance selection · migration workstream scope · parallel-run acceptance criteria · accountable owners.

    Evidence basis: Phase 1 master summary and recorded decisions: Phase 2 DOME-network consolidation; AWS as the critical priority; Data Warehouse retirement into DOME; S-Cube/BioSync retention; finance consolidation evaluation; and no net-new sprawl.

    Standard Operating Procedure

    Every system gets up to 3 paths; IONITY is the recommended route.

    The audit applied the same decision pattern to each system: capture current state, list viable alternatives, score against risk / cost / sovereignty / capability, then recommend the path that lands the estate on a leaner, funder-ready footing.

    SMART 2.0 — Clinical hub

    • A. Keep cloud-hosted with current supplier.
    • B. Re-host to Azure / third-party VM.
    • C. REC: Build offline-capable modules on Ionity edge nodes, sync to DOME.

    CHOMI / AIMEE — WhatsApp GBV bot

    • A. Stay on Botpress cloud.
    • B. Rebuild as standalone app.
    • C. REC: Hybrid WhatsApp + lightweight PWA (Option C), 3–4 week timeline.

    Finance backbone

    • A. Extend Sage Evolution V9 (EOL risk).
    • B. Dynamics 365 Business Central (~R20k/yr, 60% NGO discount).
    • C. REC: Sage X3 with S-Cube/BioSyn retention — Sage 300 phased out in ~3 yrs (Exco 22 Jul); X3 includes logistics.

    MojaMind — e-Learning

    • A. Continue with original vendor.
    • B. Replatform to a new LMS.
    • C. REC: Vendor takeover under evaluation; retain inside Azure R25k barrier.

    Data Warehouse + SSRS

    • A. Maintain legacy SQL Server stack.
    • B. Lift to Azure Synapse / Power BI.
    • C. REC: Retire into DOME-RAG reporting; replace SSRS with AI dashboard agent.

    AWS hosting

    • A. Renew reserved instance and absorb cliff.
    • B. Migrate to Microsoft Azure.
    • C. REC: Ionity Private Intranet / DOME cluster after parallel-run acceptance.

    Snipe-IT / asset register

    • A. Leave as-is on Azure.
    • B. Merge into a larger service-desk suite.
    • C. REC: Recover access, register into finance, then decommission.

    Cross-cutting rule

    • Optimise-and-consolidate before replace.
    • No net-new systems outside approved model.
    • IONITY implements the recommended path; alternatives remain documented for board reference.

    Sources: System_Assessment_Updated_Apr2026.xlsx, Full_Systems_Alternatives_Review, finance-meeting notes (25–26 Jun), and recorded platform decisions (19 Jun, 22 Jun, 24 Jun).

    DOME · Implementation — ION-IR-2026-001 v4.0 FINAL (signed roadmap)

    Implementing DOME — seven workstreams, four waves, one signed roadmap.

    This is the build view behind the R-Short recommendation: the target architecture, the consolidation map that folds 21 systems into the DOME core, and the workstream engine that delivers it — each wave gated by the acceptance criteria on the Execution Map, each system carrying its three documented paths from the SOP.

    Target architecture — the DOME network

    DOME target architecture diagram — edge nodes, Azure spine, DOME consolidation core

    Ionity edge nodes on premises · Azure identity/reporting spine retained · DOME as the single consolidation and integration core. Click to open full-size.

    Consolidation map — 21 systems → DOME core

    Consolidation map showing 21 systems folding into the DOME core with retain, consolidate and retire lanes

    Retain (Azure · S-Cube/BioSync) · consolidate (finance stack, reporting) · retire (Data Warehouse, Snipe-IT, dormant spend) — per the estate destiny map in Act 0.

    Workstreams A–G roadmap §3

    AMigrationAWS parallel-run → cut-over → decommission before the Sept cliff (F-04/F-06).
    BRemediationF-register burn-down: MFA, root keys, logging, lifecycle (F-24 · F-23 · F-03 · F-28).
    CERP / FinanceSage X3 vs Dynamics evaluation (Sage 300 ~3-yr phase-out noted at Exco); S-Cube/BioSync retained.
    DAI data platformChomi v2 local RAG · AI dashboard agent replacing SSRS · POPIA §72 closure (F-29).
    EDOME-NetworkCluster stand-up, sync node, DOME integration & reporting boundaries.
    FGovernanceQMS, records discipline, operator agreements, sign-off gates & evidence.
    GProducts & fundersFunder dashboards and the NACOSA/Gilead reporting line.

    Wave sequence — Aug → Dec 2026

    Wave 0 · Stabilise (Aug): access, ownership, evidence — Gate 01.
    Wave 1 · Foundations (Sep): cluster live, AWS parallel-run verified, exit before the cliff — Gate 02.
    Wave 2 · Consolidate (Oct–Nov): finance route executed, DW retired into DOME, Chomi v2 pilot — Gate 03.
    Wave 3 · Optimise (Dec+): AI reporting agents, funder dashboards, run-rate lands at ~R865k.

    Five alternative pathways (§2.4)

    Five alternative pathways chart A to E per roadmap section 2.4

    Routes A–E scored on risk · cost · sovereignty; Route A (Ionity/DOME) recommended.

    Hosting decision

    Hosting decision comparison chart — AWS renew vs Azure lift vs Ionity private intranet

    AWS renew vs Azure lift vs Ionity Private Intranet — the Act III case, charted.

    SOP change-control loop

    SOP change control loop flow diagram

    Capture → alternatives → score → recommend → approve → evidence — applied per system.

    Signed roadmap: ION-IR-2026-001 v4.0 FINAL (PDF + editable DOCX) — indexed in the Annex under SOP · Implementation & Alternatives; page scans & working files under Working Library. Estate mindmap (mindmap.png) and full 9-graph set linked there. Dates planning-level; every wave closes on a signed gate, not a calendar assertion.

    VII
    Act Seven · The live wire — folded in 22–23 Jul 2026

    The Exco Review — what the room confirmed.

    On 22 July the audit was tabled with Exco — Lilian, Ian, Angela, Ethan, Nathan and team. Over 300 pages, distilled from ~160 underlying documents, were walked through end to end. This act records what was confirmed, what is new, the path the room aligned on, and the nine actions that left with owners.

    Confirmed & newWordPress POPIA · .NET 10 · 24-h monitoring window
    The confirmed pathAzure 75% NPO + Ionity-hosted · Sage X3 pivot
    Action registerNine items, owners named, dates set
    AppendicesGlossary · full register · evidence · sign-off
    Exco review · 22 Jul 2026 · Lilian · Ian · Angela · Ethan · Nathan

    Three hundred pages, tabled.
    One new breach, five confirmations.

    F-30 · WordPress POPIA breach NEW · RED

    WordPress data is leaving South African data storage — a live POPIA breach on the public web estate. Remediate hosting & storage residency and fold the site into the managed estate (ties SIN-WEB-2026 · §72 · C7).

    Smart2 runtime — confirmed .NET 10+

    The .NET layer behind SMART 2.0 is out of date and exposed — confirmed in the room as a significant risk. Action: update dependencies to .NET 10 or above, executed once, properly, inside the migration window.

    Monitoring: a 24-hour memory feeds F-23

    AWS monitoring runs real-time only — a 24-hour window kept small for cost, with no historical log retention. Incident investigation has no past to look at; MON-1 and §22-ready logging answer it.

    Entra sprawl, contextualised F-28

    ~1,000 accounts vs ~260 active users. Nathan confirmed disabled/archived mailboxes hold no licences and pose no intrusion risk — so the work is cleanup, licence hygiene and JML automation, not firefighting.

    MFA — a resourcing story F-24

    MFA was switched off under adoption pressure and IT resource constraints — a capacity problem, not negligence. The remedy ships as a structured, logged MFA & password-rotation process sized to the team.

    iShout — stabilised good news

    Code confirmed relatively stable, managed by Peter after the Softdeck/Softlink handover — and no vendor fees are currently being paid. DataFree re-enablement stays on the action plan.

    Also minuted: Mimecast covers ~40 of 200+ staff — notice period believed 90 days; confirm before consolidating email onto the Azure stack · an IT architectural blueprint is required before the board & Finance Audit and Risk Committee sitting (Angela) — sequence: Exco path decision → blueprint → board · a formal, logged change-management framework and HR offboarding controls to be formalised as official internal controls.

    Source: Exco review session, 22 Jul 2026 — Notion AI transcript + action minutes (working record). ~300 pages of reporting distilled from ~160 underlying documents were tabled; a deep-dive technical session with Nathan follows this week.

    Direction of travel — as presented to Exco

    Leave AWS entirely. Land on Azure at 75% NPO + Ionity-hosted services.

    AWS · TODAYR9k/mo committed · cliff Sep-26decommission after acceptance PARALLEL RUN · ~2 MONTHSbuild & test first · then semi-liveR25k double-running absorbed AZURE · 75% NPOidentity · M365 · reporting · MojaMind+ Ionity–Microsoft partner discounts IONITY-HOSTED · DOMEclinical core · sync · edge AI · flat rand feeowned hardware · no lock-in
    0%
    Azure NPO discount the organisation qualifies for — partner discounts on top
    ~0 mo
    estimated migration window — build & test → semi-live → decommission; no big-bang
    R0k
    double-running cost absorption carried by Ionity through the transition
    0 d
    believed Mimecast notice period — confirm, then consolidate email to Azure

    Long-term core

    Azure + Sage (X3) as the platform spine — fragmented vendors eliminated, full ownership and access retained, lock-in explicitly designed out.

    Audits, automated

    The IA·MCP audit engine (~90% complete) ships as an included service — no subscription cost: automated, recurring compliance audits (e.g. weekly), evidence to the locker.

    Impairment-ready

    A structured decommission list is provided for internal impairment testing before anything is switched off — finance stays ahead of the estate.

    As presented and minuted, Exco 22 Jul 2026. Consistent with Act III: the CLINICAL-tier intranet remains the recommended landing for the clinical core; Azure (75% NPO) carries identity, productivity, reporting and the MojaMind landing. NIST CSF 2.0 tabled as candidate governance frame — final choice follows the selected route.

    Nine actions left the room with owners

    The action register — tracked to done.

    #ActionOwnerDue / status
    A-1Share the live link to audit reports & documentation with all attendeesJohanDONE — this site
    A-2Face-to-face follow-up — Thursday 10:00, Parktown office (Nathan in person; Ian may join remotely)Allthis week
    A-3Present recommended pathways, timelines & costings for Exco considerationJohannext session
    A-4Provide the decommission list for internal impairment testingIonity + Finance7 days
    A-5Review & resolve the WordPress POPIA breach (F-30)IT + Ionity30 days · P1
    A-6Update Smart2 .NET dependencies to .NET 10 or aboveIonitymigration window
    A-7Assess AWS RDS downscale options before the September deadlineIT + Ionitybefore Sep-26
    A-8Confirm the Mimecast notice period (~90 days) & initiate Azure consolidation if decidedIT30 days
    A-9Stand up a structured, logged MFA & password-rotation process sized to IT capacityIT + Ionity30 days

    Blueprint before the board

    An IT architectural blueprint is required ahead of the board & Finance Audit and Risk Committee meeting. Sequence agreed: pathways & costings to Exco → decision → blueprint → board pack. The two-month window is tight — it is scheduled first.

    Change control, formalised

    A formal change-management & logging framework plus HR offboarding controls (access revocation, data removal) are adopted as official internal controls — every change auditable, every leaver closed out.

    Register minuted 22 Jul 2026; owners per the meeting record. Items A-5 → A-9 map to findings F-30 · F-06 · F-07 · F-04 · F-24/F-03 respectively and are absorbed into the 90-day calendar (Act V).

    Appendix A · plain language

    Every term in this deck, decoded.

    DOMEIonity's consolidation architecture — one integration & reporting core on sovereign edge nodes with an Azure spine.
    IA·MCPIonity's in-house forensic audit engine — 20 tools, connect → harvest → score → report, evidence-lockered per run.
    AI-MIonity's 5V/20W intelligent motherboard line (2026) — True-Edge-AI compute that slots into the node cluster.
    RAGRetrieval-Augmented Generation — a local model answers from a vetted document corpus instead of scripted menus.
    Edge AIAI inference running on premises hardware — data never leaves the building to be processed.
    POPIA C7Condition 7 — security safeguards: the duty to secure personal information against loss or unlawful access.
    POPIA §72Cross-border transfer rules — personal information may only leave SA under specific protections.
    POPIA §22Breach notification — the Regulator and data subjects must be notified of compromises without undue delay.
    RYGRed / Yellow / Green rating applied to every finding — severity at a glance.
    SPOFSingle point of failure — one person, system or node whose loss stops the operation.
    JMLJoiner-Mover-Leaver — the identity lifecycle that grants, adjusts and revokes access as staff change.
    RDS · Single-AZAWS managed database; Single-AZ means one availability zone — no automatic failover (F-27).
    CloudTrailAWS's API activity log — dark in 18/18 regions here (F-23); without it, a breach leaves no record.
    Entra IDMicrosoft's cloud identity directory (ex Azure AD) — the retained identity spine for the estate.
    PITRPoint-in-time recovery — restore a database to any moment, not just the last backup.
    RPO / RTORecovery point / time objectives — how much data and how much downtime a failure may cost.
    3-2-1 backupThree copies, two media, one off-site — the backup discipline built into BAK-1.
    WireGuardModern encrypted VPN mesh — the only way into the intranet cluster's perimeter.
    NPO discountMicrosoft's non-profit pricing — Azure at 75% off for qualified organisations (confirmed at Exco).
    Impairment testingFinance's write-down check on assets being retired — fed by the decommission list (A-4).
    FARCFinance Audit and Risk Committee — the governance body the blueprint must reach before the board.
    NIST CSF 2.0The US cybersecurity framework, 2024 revision — tabled as a candidate governance frame at Exco.
    EOLEnd of life — software past vendor support; it still runs, but no one patches it (Sage V9, old .NET).
    CAPEX / OPEXOnce-off capital vs recurring operating spend — R118.5k cluster CAPEX vs R7,950/mo OPEX.

    Working definitions for board reading — statutory wording per POPIA (Act 4 of 2013) and the cited frameworks prevails in formal use.

    Appendix B · F-01 → F-30 at a glance

    The complete register — nothing off the page.

    F-02
    Supplier / developer concentration on the clinical core — custody & knowledge loss
    F-03
    Identity lifecycle gap — HR → IT joiner/mover/leaver unwired; orphaned access
    F-04
    Email-security coverage gap — ~40/200+ on Mimecast; live phishing observed
    F-05
    Backup & DR evidence gaps — systems not correctly backed up; SPOF risk; no tested restore
    F-06
    Clinical core maintenance dark ~18 months; runtime EOL → .NET 10+ path set
    F-07
    AWS commitment cliff — Sep-2026; R9k → R60–70k/mo on lapse
    F-08
    Azure billing anomaly — invoices read zero post write-off; regularise before landing
    F-09
    Finance fragmentation — five parallel tools, no single ledger
    F-10
    Sage Evolution V9 end-of-life path — replacement is a priority
    F-11
    Snipe-IT dormant — R72k/yr paid, unused, register unrecoverable from source
    F-12
    Data Warehouse never live — R60k/yr; supplier bankrupt; retire into DOME
    F-01 · 13–16
    Baseline & process lines — asset inventory, availability (2× 2-day outages), website audit actions (SIN-WEB-2026), payroll SPOF, records discipline — full write-ups in Final Report §5–6
    F-17
    Residency CONFIRMED — clinical DB af-south-1; §72 closed; 2 residuals to clear
    F-18–22
    Compliance workstream — special-PI scope · minors & Children's Act · HPCSA · operator agreements · funder mapping
    F-23
    CloudTrail disabled 18/18 regions; no Config/GuardDuty; 24-h monitoring window only
    F-24
    Root key + 0/6 IAM users with MFA; keys aged 1,374–1,633 days
    F-25
    Security groups open to 0.0.0.0/0 on sync & enrolment tiers
    F-26
    S3 bucket “shoutitnow-hosted-content” publicly accessible
    F-27
    Clinical RDS Single-AZ — no automatic failover on the hub database
    F-28
    Entra sprawl — ~1,000 objects vs ~260 active users; cleanup, licences, JML
    F-29
    CHOMI on Botpress cloud + offshore LLM — special PI crosses border twice
    F-30
    WordPress data leaving SA storage — POPIA breach (Exco, 22 Jul)
    0
    RED lines — act inside 30 days
    0
    AMBER lines — scheduled into the 90-day plan & waves
    1
    GREEN — residency, confirmed by scan
    100%
    of lines carry a priced remedy in this deck or the written register

    Condensed one-line view; authoritative text, risk scores and POPIA mappings per finding live in Final Report Phase 1 v3 §5–6 (Annex). RYG as at 23 Jul 2026 — F-28/F-29 from the 20 Jul console review, F-30 from the 22 Jul Exco review.

    Appendix C · where every claim can be checked

    Evidence index — 485 files, one map.

    Console captures

    Cost Explorer CSV (Jan–Jun 2026, $529.38/mo avg) · IAM users CSV (0/6 MFA) · region check (af-south-1 + eu-west-1) · Botpress analytics CSV — all captured 20 Jul 2026, account 334982276367.

    ↳ open in Annex · group 12

    Reports & sign-off

    Final Report Phase 1 v3 · ENDHANDIN (20 Jul) · Finance Internal Audit (W2) · Website Audit SIN-WEB-2026-R01 v1.4 · AI Platform Architecture · Change Management Plan v1 · SmartSuite recommendation.

    ↳ open in Annex · group 01–05

    System profiles

    14 per-system assessments — SMART 2 · SNowI · CHOMI · iShout · MojaMind · Sage · Fusion · SSRS · M365 · FreshService · eLearning · Data Warehouse · Snipe-IT — each with findings & remedies.

    ↳ open in Annex · group 03

    Scans & forensics

    IA·MCP engine runs (posture 33.7 · cloud 49.1) · AWS Trusted Advisor 30 Jun (CloudTrail 18/18 red) · Apr-2026 assessment workbook · evidence index & SHA-256 import manifest.

    ↳ the instrument

    Meeting record

    42 dated notes + 30 ION-MMR reports & summaries, Jun–Jul 2026 — including the Sage demos, platform decisions, finance audits and the 22 Jul Exco review transcript.

    ↳ open in Annex · groups 07–08

    Roadmap & graphics

    ION-IR-2026-001 v4.0 FINAL (signed) · 9-graph decision set (architecture, consolidation, costs, Gantt, pathways, hosting, SOP loop) · estate mindmap · page scans.

    ↳ the roadmap, rendered

    Chain of custody: the complete non-secret record is versioned in SHOUTITNOW-AUDIT-REPO (485 files) beside this file, under POL 986 AED. Credential files are held separately by design. Late additions carry SHA-256 provenance in the import manifest. Every figure in this deck cites its source line in the page foot-notes.

    Referenced from the IA·MCP instrument page as “Appendix C” — this page closes that pointer. Curated 23 Jul 2026.

    Acceptance · Phase 1 close-out

    Sign-off — Phase 1 closed, Phase 2 armed.

    Acceptance statement

    By signing, Shout-It-Now NPC acknowledges receipt and review of the Phase 1 IT Systems Audit (DOC-2026-07-021 V1.1 · Q021-SN01-AD1-26D), including the findings register F-01→F-30, the gains ledger, the AWS-exit recommendation with alternatives, and the Exco action register — and records its elections below.

    D-1 — AWS exit: Option A (Ionity intranet, CLINICAL tier) approved / alternative selected: ____________
    D-2 — Finance backbone: Dynamics 365 (NGO) / Sage X3 — decision recorded after the NPO demo
    D-3 — Quick-win mandate: decommissions, credential rotation, mailbox true-up authorised
    D-4 — Phase-2 scope: migration + DOME + Chomi v2 quotation accepted for sign-off
    D-5 — NACOSA AI reporting agent scoping green-lit (optional)

    Elections may be made severally; D-1 and D-3 are the time-sensitive lines (Sep-26 window · live phishing exposure). This page prints with the full document (press P).

    For Shout-It-Now NPC

    Authorised signatory — Corporate Services / Exco
    Name & capacity
    Signature
    Date · place

    For Ionity Global (Pty) Ltd

    Johan Wilhelm van Antwerp — Founder · Technical Lead & Architect
    Signature
    Date · place

    Executed copies to be lodged in 01_Final_Reports_and_Signoff under POL 986 AED. Governance: Policy 986 AED · AED 900 · TM. Witnessed counterparts acceptable; electronic signature per ECTA 25 of 2002 recognised.

    Thank you

    Audit complete.
    Conversation continues.

    Scan the code to join the private Shout-It-Now × Ionity forum. Ask follow-up questions, track Phase 2 decisions, and access curated updates as the DOME build progresses.

    ionity.art

    Forum hosted at ionity.art — not www.ionity.art. Repository remains private; only this presentation is published on ionity.xyz.

    VIII
    Release 2 · v2.21 · onsite handover folded in · 23 Jul 2026

    The full picture is closed.
    Now execution becomes the record.

    The final seven-page onsite handover, the full document repository, the signed DOME roadmap and the Exco record are reconciled here into one controlled implementation baseline: 17 actions, four waves, six workstreams and evidence-based closure gates.

    Full-picture verdictRisk · cost · target state · decision boundary
    17-action registerOwners · target windows · acceptance evidence
    Implementation planContain → decide → migrate → optimise
    Release 2 packOriginal PDF · printable plan · operational CSV
    ION-AUDIT-HANDOVER-2026-002 · executive conclusion

    Fragmented today. One governed DOME tomorrow.

    The assessment found a capable estate carrying too many overlapping contracts, weak recovery and identity controls, data-residency exposure and avoidable operating spend. The answer is consolidation, not indiscriminate replacement.

    R620Kpotential annual waste or redundant spend identified across the estate
    R1.2M → R865Kcurrent run-rate to projected consolidated baseline
    33%Azure MCP compliance baseline requiring governance and security lift
    55%AWS category reduction opportunity from the primary near-term exit

    Contain first

    Open HTTPS/VPN tunnel leakage · Chomi/BotPress data leaving the boundary · finance server with no backup or redundancy · stale credentials and inactive identities · outdated SmartTool .NET dependencies.

    Target state

    Azure backbone + Ionity DOME + BioSync + Sage X3/Sage 200, with Power BI reporting, AI through governed APIs, owned data, tested recovery and no forced vendor lock-in.

    Finance & analytics

    Price Sage X3 for five users, remove Fusion duplication, retain K-Sphere only if justified, train Finance/HR on included Power BI and complete the SSRS deep dive.

    Applications & communications

    Decide MojoMind after a technical deep dive; preserve Chomi data; replace partial Mimecast coverage; move unstable WhatsApp arrangements; do not renew unused Salesforce.

    Control principle: no system is switched off until its owner, export, recovery route, financial treatment, acceptance test and rollback position are recorded.
    Controlled register · H-01 to H-09

    Immediate containment, pricing and decision gates.

    IDRequired actionAccountableTarget
    H-01Share live document/report links with the team — password-protected, accessible via slide 53 index.Johanimmediate
    H-02Provide detailed Sage X3 costing for five users and send it to Pierre.Johan5 business days
    H-03Conduct the MojoMind (Merge Your Mind) technical deep dive.Johan + teamproposed Tuesday
    H-04Issue a formal MojoMind salvage assessment and quote.Johan2 days after H-03
    H-05Decide MojoMind: go live as-is, salvage, or pull the plug — next meeting with Stellenbosch.Lillian + Dr. MThursday
    H-06Back up and store Chomi/BotPress data before project end in September.IT + Ionitybefore September
    H-07Provide Minecast alternatives: two commercial options and one open-source option.Johan10 business days
    H-08Decommission Snipe-IT — export to Excel/dead storage, complete impairment treatment, remove from Azure.IT + Finance + Ionity30 days
    H-09Migrate the finance server to cloud with backup, restore, monitoring and rollback evidence.IT + Finance + Ionity30–60 days
    MojoMind gate: code, content, hosting, QA requests, remaining spend and Stellenbosch deadline must be evaluated together — sunk cost does not replace a technical acceptance test.
    Finance gate: Sage X3 TCO must include five users, hosting, migration, integration, Fusion displacement, reporting and the cost of avoiding a second Sage 300 migration.
    Controlled register · H-10 to H-17

    Control uplift, capability and vendor exits.

    IDRequired actionAccountableTarget
    H-10Clean Azure IAM/Entra stale credentials and inactive users.IT + HR + Ionity~6 weeks
    H-11Address open HTTPS/VPN tunnel data leakage and record the compliance reporting decision.IT + Ionity + Info Officerimmediate
    H-12Arrange Power BI training for Finance and HR teams; accept two pilot dashboards.Finance + HR + Ionity30 days
    H-13Explore the Microsoft 365 partnership programme for lower pricing.Johan + Partner Desk14 days
    H-14Cancel Salesforce at the next renewal; export required data and confirm the replacement.Leadership + Procurementbefore renewal
    H-15Schedule the internal team meeting for the end of next week.LeadershipThursday
    H-16Investigate the SmartTool .NET dependency update before AWS migration; obtain the current developer quote.App owner + Vendor + Ionitybefore migration
    H-17Provide the Minecast migration plan to Azure-hosted email security.Johan + IT10 business days

    Evidence of containment

    Clean scan · legal/reporting decision · encrypted backups · restore tests · revoked credentials.

    Evidence of migration

    Accepted landing · parallel-run result · rollback test · monitoring · source retirement approval.

    Evidence of control

    Named owner · signed decision · operating procedure · training record · measured savings.

    The operational CSV in the Release 2 pack carries these actions with workstream, owner, target, priority, status and acceptance-evidence columns.

    Implementation baseline · controlled by gates, not dates alone

    Contain → decide → migrate → optimise.

    WAVE 0 · 0–72 HOURS

    Contain

    • Close tunnel exposure.
    • Preserve Chomi and finance data.
    • Record reporting decision.
    • Issue Release 2 pack.
    Gate: clean scan + restore proof + accountable owner.
    WAVE 1 · DAYS 1–14

    Decide

    • Sage X3 five-user TCO.
    • MojoMind deep dive and verdict.
    • Email-security options.
    • M365 discount validation.
    • .NET 10 upgrade path.
    Gate: signed choices with cost, owner, date and rollback.
    WAVE 2 · DAYS 15–60

    Migrate

    • Azure/Ionity landing.
    • Finance-server move.
    • AWS parallel run and exit.
    • Identity clean-up.
    • Snipe-IT and email transition.
    Gate: production acceptance before source retirement.
    WAVE 3 · 61–90 + RENEWAL

    Optimise

    • DOME consolidation.
    • Power BI adoption.
    • Salesforce non-renewal.
    • WhatsApp migration.
    • Recurring IA·MCP checks.
    Gate: measured savings + operating controls + closure sign-off.
    Critical dependency chain: containment → leadership decisions → supplier quotes/access → accepted landing zones → controlled decommission → measured benefits. Skipping a gate converts savings into operational risk.

    Full printable plan: ION-AUDIT-HANDOVER-2026-002_Implementation-Plan_Release-2_v2.21.html. It supplements, and does not replace, the signed ION-IR-2026-001 v4.0 DOME roadmap.

    Total scope · every stream has a definition of done

    The work is complete only when evidence exists.

    A · Governance & Compliance

    Tunnel exposure · POPIA/reporting decision · change logging · HR offboarding/JML · recurring IA·MCP checks.Done: controls have named owners and retained evidence.

    B · Cloud & Recovery

    AWS exit · Azure landing · finance recovery · backup validation · monitoring · rollback.Done: target workloads accepted before source retirement.

    C · Finance & Analytics

    Sage X3 TCO · Fusion elimination · K-Sphere decision · Power BI training · SSRS deep dive.Done: Finance signs the target backbone and reporting controls.

    D · Applications

    MojoMind decision · SmartTool .NET 10 · Snipe-IT retirement · Salesforce exit · hosting moves.Done: every system has retain, migrate or retire evidence.

    E · Communications & AI

    Chomi preservation · Mimecast replacement · WhatsApp migration · governed Azure-hosted AI direction.Done: coverage, retention and data residency are accepted.

    F · Commercial & Handover

    Microsoft discounts · renewal dates · impairment treatment · controlled documents · review cadence.Done: contracts, costs, decisions and owners reconcile to one register.

    Outcome measure: all 17 actions closed with acceptance evidence; target architecture approved; service ownership transferred; run-rate measured against ~R865K; no source retired early.
    Strategic conclusion: strong systems remain. The value is unlocked by consolidating identity, hosting, data, finance, reporting and governance around Azure + Ionity DOME.
    Final note · implementation phase · starting point

    The plan is laid down. We will share the path.

    This notice marks the transition into implementation, immediately before the DOME execution path. The next core ideal is a governed operating backbone built around Sage · Azure · BioSync, supported by an AI platform of choice and Ionity software shared on a non-hostage, no-lock-in basis.

    Optional Azure operating path

    Running purely on Azure with Ionity support remains an optional hosting route. Where feasible, Ionity will assist with hosting and absorb agreed transition costs to protect growth. The architecture remains portable: client custody, documented integrations and freedom of platform choice are retained.

    Implementation target: reduce the on-paper annual run cost from approximately R1.2 million to below R490,000. This is an achievable target with the correct implementation, subject to final supplier quotes, licence counts, migration scope and acceptance testing.

    Implementation roadmap

    3–7 weeks
    Ionity-led system changes, applied as required and controlled through agreed completion gates.
    3–5 weeks
    System cut-over beginning with AWS, overlapping safely with the remaining systems and preserving rollback.
    ~3 weeks
    Potential MojoMind assistance: development, structured takeover, custody and control for future versions; later-version costs confirmed separately in writing.
    Parallel
    Remove Mimecast on the approved path; complete custom system work and integrations without disrupting operations.

    Licence control

    Keep licences current with automated inventory, renewal and usage tracking as part of Ionity services.

    Hardware & security

    Supply and maintain laptops and security-related hardware, with security delivered through approved channels.

    Partner pricing

    Use Ionity’s Microsoft and Google partner channels to pursue reseller discounts and competitive pricing.

    Training & onboarding

    Provide onsite training days and online onboarding, delivered by Ionity or managed third parties to reduce load on Shout-It-Now.

    Implementation sequencing remains governed by the signed roadmap, verified backups, parallel running, documented acceptance and written approval before decommissioning.

    Release 2 · v2.21 · controlled handover pack

    The source, the plan and the operating register.

    These three files are embedded in the portable application and open offline in the appropriate system viewer. The signed DOME roadmap and complete evidence repository remain linked in the final archive.

    SOURCE · PDF · 7 PAGESFinal Onsite Audit HandoverOriginal report · ION-AUDIT-HANDOVER-2026-002 v1.0 · 23 Jul 2026 CONTROLLED PLAN · HTMLImplementation Plan · Release 2Four waves · six workstreams · dependencies · risks · completion gates OPERATIONS · CSV17-Item Action RegisterOwners · targets · priorities · status · required acceptance evidence
    Signed DOME Implementation Roadmap · v4.0 FINALPDF Consolidated Evidence Repository GuideREADME
    Final conclusion: the audit is no longer only a statement of findings. Release 2 · v2.21 is the execution baseline — one source report, one implementation plan, one action register, one complete evidence archive.

    Source PDF SHA-256: 1934034885CD9FD1B89A44A725C7E07F63A1A5665D23520DCD1271C0E1C35FB5

    The recommended path · the whole scope, self-building

    One core. A Dome around it — Azure · Sage · BioSyn · Ionity + governed AI.

    The whole scope in one view: AWS applications move over to Azure and Ionity where each belongs, Sage X3 and BioSyn carry finance and workforce, and a governed AI of our choosing wraps the estate. The Dome is the protective governance shell around the single consolidated core — the map builds itself point by point until the whole picture stands.

    THE DOME · governance · POPIA §22 logging · no lock-in AWS · TODAY SMART 2.0 · SNowI 2 · iShout apps move over → then exit CONSOLIDATED CORE one governed estate single source of truth AZURE · 75% NPO identity · M365 · Power BI · MojaMind SAGE X3 finance · supply chain · logistics BIOSYN payroll · T&A · biometric sync IONITY-HOSTED clinical core · edge · sync · flat fee GOVERNED AI Chomi v2 · local RAG · API-injected

    Total scope, one map: fragmented vendors eliminated, AWS retired after acceptance, Azure + Sage X3 + BioSyn + Ionity under one Dome, AI chosen and governed. Take all into account — the whole requirement, the whole estate, drawn as it will be built.

    The path that builds itself · quick wins first

    Start with the low-hanging fruit — the savings compound as you go.

    Each dot is a quick win that funds the next. The path reveals itself in sequence — from the first easy cut through to the fully consolidated Dome.

    AWS EXITcliff removed MIMECAST CUT→ Azure email security FUSION CUTfolded into Sage X3 SNIPE-IT OFF−R48k/yr dead spend SALESFORCEnon-renewal · Power BI DOMEfully consolidated

    The actual foreseen cost overall is a cut-down from R1.2 million runtime into a R478,000 max runtime per year — possible with a minimum of half cut as the implementation is followed.

    Foreseen figure — subject to final supplier quotes, licence counts, migration scope and acceptance testing. Half-cut is the floor, not the ceiling: the Dome path drives it lower as each quick win lands.

    Archive · every deliverable in one place

    Document Archive

    Release 2 · Final Handover PackOriginal onsite report, controlled implementation plan and operational action register.3 FILES · v2.21
    Final Onsite Audit Handover · ION-AUDIT-HANDOVER-2026-002PDF · 7 pages Final Audit Handover Implementation Plan · Release 2 v2.21HTML · printable 17-Item Operational Action Register · Release 2 v2.21CSV · controlled
    Final ReportsSigned audit deliverables — Phase 12 FILES
    Final Report · Phase 1 · v1.0DOCX MINECAST ReportDOCX
    Implementation Roadmap · ION-IR-2026-001DOME build — v4.0 FINAL2 FILES
    Roadmap v4.0 — FINALPDF Roadmap v4.0 — FINALDOCX
    Signed Evidence ScansWet-ink pages — finance & implementation-roadmap sign-off14 SCANS
    Finance p.07JPG Finance p.09JPG Roadmap p.01JPG Roadmap p.05JPG Roadmap p.07JPG Roadmap p.08JPG Roadmap p.09JPG Roadmap p.11JPG Roadmap B p.05JPG Roadmap B p.06JPG Roadmap B p.07JPG Roadmap B p.09JPG Roadmap B p.11JPG Roadmap S p.09JPG
    Ionity Global — Corporate & LicensingPortfolio, EULA, AED license & Policy 986 AED metadata4 FILES
    Ionity Global Portfolio V7 · REV 1PDF End-User License Agreement (EULA)PDF Ionity (Pty) Ltd — AED LicensePDF Policy 986 AED — v7.3.1 Active · MetadataPDF
    Consolidated Repository · Release SetCanonical handover copies and repository guide3 FILES
    Final Report · Repository CopyPDF Final Report · Repository CopyDOCX Consolidated Repository GuideREADME

    In the Ionity Audit Deck app these open in your system viewer (Word / PDF). On the web they open or download in a new tab. All files ship inside the application — no internet required.