Review copy — do not distribute · POL 986 AED
Ionity Global · Client briefing

The audit is complete.

Enter the authorised client workspace to review the final Phase 1 findings, evidence, financial case, target-state DOME direction, and recommended next actions.

Shout-It-Now NPCPhase 1 finalConfidential client material

Client access

Use the account details provided with the briefing.

This sign-in screen controls presentation access in the browser. Repository access remains protected by the private GitHub organisation repository.
Ionity GlobalIONITY× SHOUT-IT-NOW
Final Audit Presentation
ACT 0 · OPENINGConfidential — Client
←→ navigate · M index · P print all
Mission Index

Every view, one map.

Ionity Global logo
IONITYGlobal (Pty) Ltd · AEDI · Building Tomorrow, Today
IT Systems Audit · Phase 1 → Final

The Findings are in.
Now the Gains begin.

The end-to-end IT audit for Shout-It-Now NPC — 21 systems, closed and costed. The money, the low-hanging fruit, and the engineered exit from AWS onto Ionity Private Intranet hosting, with Azure retained as the backbone.

IONITY GLOBAL
prepared for
EngagementQ021-SN01-AD1-26D
DocumentDOC-2026-07-021 · V1.0 FINAL
Date20 July 2026 · SAST
AuthorIonity Global (Pty) Ltd
Webwww.ionity.co.za
Document Control

On the record, under governance.

Identity

Document ID
DOC-2026-07-021
Version
1.0 — FINAL (presentation layer)
Engagement
Q021-SN01-AD1-26D · QTE-2026-002
Classification
CONFIDENTIAL — CLIENT
Governance
Policy 986 AED · AED 900 · TM
Author
Ionity Global (Pty) Ltd · AEDI
Prepared for
Shout-It-Now NPC — L. Monji · N. Daya · P. van Papendorp

Primary evidence repository 485 files · audited

Presentation layer of the consolidated audit. The complete non-secret evidence set is versioned in SHOUTITNOW-AUDIT-REPO beside this file. The Annex remains a curated client view; the primary repository is the full record.

  • Reports: Final Report Phase 1 v3 · SPINE v0.2 · IT-Audit Report-01 · Website Audit SIN-WEB-2026 · Finance Internal Audit (W2) · SmartSuite Recommendation
  • 14 System Profiles: SMART 2 · SNowI · CHOMI · iShout · MojaMind · Sage · Fusion · SSRS · M365 · FreshService · eLearning · Data Warehouse · Snipe-IT (F-28)
  • Quotes & scope: ION-QUO-001 (v4/v5/MULTI) · ION-QUO-002 · Phase-1 Quotation · IT-Audit Scope Ref · QTE-Audit-Questions · Annexure A
  • Forensic: IA·MCP scan outputs · evidence index · System Assessment Apr-2026
  • Legal: Mutual NDA v1.2 (signed) · SLA v1.0 · SOW · Compliance Questionnaire v3 · New Vendor Form
  • Meeting reports: ION-MMR-2026-01→17 series · 8× Word summaries · 30+ notes & Notion pages (Jun–Jul 2026)
  • FLOW & AI: Shout Flow Operational Research Protocol · Dashboard/NACOSA proposal · DOME cost models
  • AWS evidence (20 Jul): cost & usage CSV · IAM users CSV · region check · SMART 2.0 user guide · Change Mgmt Plan v1

Figures marked indicative are drawn from recorded register costs and audit estimates; vendor quotes to confirm at sign-off. This page prints — press P for the full paged document.

Audit Repository Context

Overall context and folder-level findings.

Overall Context

This audit workspace combines executive reporting, evidence artifacts, meeting records, financial assessments, and implementation alternatives into one controlled delivery set. The structure supports two objectives: board-level decision clarity and traceable technical evidence for follow-through.

Repository Shape

The delivery is split between a working stream and a consolidated repository stream. The working tree preserves operational history and duplicates from collection phases, while the consolidated tree is curated for stakeholder handover and sign-off.

Finding Theme

Across folders, the pattern is consistent: spending is fragmented, governance is uneven, and high-impact savings exist. The strongest gains come from de-duplication, platform consolidation, and controlled migration out of high-risk cost zones.

Folder-Related Findings

01_Final_Reports
Final reports are present and decision-ready, but version spread indicates parallel drafting before convergence.
02_Finance_Audit
Cost and audit records expose duplicated spend lines and consolidation opportunities that feed the recurring savings model.
03_System_Profiles
System profiles provide broad coverage; several tools show overlap or low-value retention against current operating priorities.
04_Assessment_*
Assessment and alternatives content supports migration sequencing, but confirms dependency risk if governance controls lag execution.
08/09 Meetings & Notes
Meeting artifacts are rich and consistent, enabling evidence-backed decisions; however, action closure discipline must stay strict to protect momentum.
10/12 AWS Evidence
Cloud evidence confirms urgent risk posture and validates the financial case for a controlled AWS exit and hardened target-state operations.

What This Means

  • Context is now explicit from executive summary down to evidence folders.
  • Findings are mapped to repository domains, not treated as isolated observations.
  • Savings governance linkage is strengthened for board review and implementation control.

Use this page as the handoff bridge between strategic narrative and source-folder evidence during reviews.

Executive Summary — the one-pager

A capable estate, paying for its past —
with a funded path out.

The verdict

Mission-critical delivery works — mobile clinics run on SMART 2.0 daily. But posture maturity is “Initial”: fragmented finance, dormant paid-for tools, no maintenance cadence on the clinical core, and a cloud perimeter left unguarded — CloudTrail dark, a root key without MFA, security groups open to the internet. Residency itself checked out: af-south-1, confirmed.

The money

~R1.2m/yr total IT run-rate — of which ~R620k is flagged poor value (fragmented, duplicated, dormant). The audit banks ≈R335k/yr recurring gains and removes an AWS cliff worth up to R630k/yr from Sep 2026.

The move

Exit AWS entirely. Clinical core to Ionity Private Intranet hosting on micro-computing nodes — POPIA-resident by design. Azure is retained as the productivity & identity backbone; what fits moves there under a R25,000 migration-absorption barrier carried by Ionity.

Act now (30 days)

Enforce MFA (0/6 on AWS) · reconcile the 1,000+ Entra identities vs ~200 mailboxes · close the email-security gap — risk of not all employees covered · decide the AWS exit before the Sep-26 window.

Bank the fruit (90 days)

Decommission dormant Snipe-IT (R72k/yr) · retire the never-live Data Warehouse (R60k/yr) · right-size the shared RDS · confirm the finance consolidation path.

Build forward (6 months)

Stand up the Ionity intranet cluster in parallel · migrate AWS workloads with zero clinic downtime · land the estate at a ~R285–320k/yr run-rate.

The audit, in numbers

Twelve figures that tell the whole story.

0
systems assessed across internal & client-facing tracks
0
register findings F-01→F-27 in the consolidated Phase 1 v3 register
R1.2m
total annual IT run-rate across the estate (client finance view)
R0k
of it flagged poor value — sprawl, duplication & dormant tools
7–8×
AWS cost multiple if the commitment lapses in Sep-2026 (R9k → R60–70k/mo)
0/18
of 18 AWS regions with CloudTrail logging disabled — no Config, no GuardDuty (F-23)
Email
email-security gap — risk of not all employees covered (F-04)
2
paid-for systems found dormant — Snipe-IT & the Data Warehouse
R0k+
per year of identified recurring gains — the ledger, itemised inside
R0k
per year of AWS cliff exposure removed by the exit
~0 mo
payback on the Ionity intranet cluster vs today's AWS run-rate
R0k
Azure migration-absorption barrier — carried by Ionity, not the client

Sources: consolidated system register & profiles (QTE-2026-002), findings register F-01→F-27 (Phase 1 v3), cost model baseline ≈R213k/yr (F-07-gated), progress minutes 26 Jun 2026 (~R620k poor-value subset); full run-rate ≈R1.2m/yr from summed system costs (finance view); AWS console-verified 20 Jul 2026. Indicative pending final vendor confirmations.

Methodology

Five foundations. Ten pillars.
Optimise-and-consolidate before replace.

General Foundations every system

01
Asset inventory — hardware, software, shadow IT
02
Security & access controls — MFA, least privilege
03
Backup & disaster recovery — proven by restore
04
Network performance & capacity headroom
05
Compliance & policy enforcement

RYG-rated per system · 5×5 likelihood × severity risk matrix · findings stated as observed, or “requires confirmation”.

Specific Pillars custom · multi-cloud · AI · sensitive data

01
Integrations & data flows — risk lives in the seams
02
Vendor & source-code custody
03
Cloud configuration posture
04
Logging, monitoring & IR readiness
05
Identity lifecycle — joiner / mover / leaver
06
Patch & change management as processes
07
Data classification, retention & destruction
08
AI & model governance
09
Architectural single points of failure
10
Cost & licence rationalisation — surface savings

Evidence: stakeholder interviews, the Apr-2026 assessment workbook, AWS / Azure / M365 scans, and the IA·MCP forensic engine.

The Instrument

IA·MCP — Ionity's forensic audit engine, pointed at your estate.

Beyond interviews and workbooks, the estate was swept with IA·MCP v1.7.0 — Ionity's in-house audit engine: 20 forensic tools driving a connect → harvest → score → report chain, with every run recorded to an evidence locker for drift comparison.

connect_estateiam_reviewlog_review run_auditcloud_audit_jobweb_audit remediation_ticketscompliance_driftrecord_audit +11 more

Framework alignment baked in: CIS v8 · ISO/IEC 27001:2022 · SOC 2 · NIST 800-53 r5 · POPIA — 100 controls evaluated per run, RBAC-gated (auditor / architect), reports kept private under Policy 986 AED.

Engine verification runs (deterministic, rule-based scoring): estate-pattern posture 33.7/100 · cloud-audit job 49.1/100 — both Grade F, maturity “Initial”. Estate-specific outputs live in the evidence index (Appendix C).

What the engine confirmed

  • Maturity “Initial” — controls exist by accident, not by design
  • Dual-cloud split posture — identity in Azure, clinical in AWS, monitoring in neither
  • No centralised logging — POPIA §22 notification would be hard to meet in time
  • A clean, scriptable migration surface — the estate is basic and movable: the exit is low-complexity
Systems Landscape

21 systems — mapped by criticality and destiny.

Every chip carries its future: INTRANET moves to Ionity private hosting · AZURE lands in the retained Microsoft estate · CONSOLIDATE folds into the finance backbone · RETIRE stops costing money.

Critical

SMART 2.0 · clinical hub SNowI 2 · follow-up CRM CHOMI / AIMEE · GBV bot S-Cube · payroll & T&A

If these go dark for 24 hours, field clinics and payroll stop. They lead every decision in this report.

High

iShout · AGYW app eLearning · built, dormant MojaMind · e-art MH M365 · Azure AD Sage Evolution V9 Fusion · DoA control

Sensitive-data platforms and the finance spine — the consolidation battleground.

Low–Medium

Snipe-IT · dormant Data Warehouse · never live Salesforce · leads only SSRS · reporting FreshService · helpdesk WhatsApp · channel

Where the dead spend hides — two of these are paid for and switched off.

Hub & spokes

SMART 2.0 is the anchor: SNowI 2, ShoutLink, iShout, eLearning and MojaMind all reference its shared AWS environment. Move the hub, and the spokes follow in one motion — one migration, five systems.

Time-sensitive

The AWS commitment window (Sep-2026) and the email-security gap reward action this quarter. Everything else can follow the phased plan.

Baseline Posture

Where the estate stands — before the plan lands.

33.7/100
IA·MCP posture score — Grade F · maturity “Initial” · 100 controls evaluated
49.1/100
Cloud-audit job score — dual-cloud configuration & IAM posture sweep
83/100
Projected posture after the roadmap — patched core, resident data, single ledger, live monitoring

Drag: hygiene

0/6 IAM users with MFA · root key without MFA · CloudTrail dark in 18/18 regions · 4 dormant/vendor accounts still enabled · keys unrotated for 4+ years.

Drag: structure

Five parallel finance tools · dual-cloud with split identity · SPOF concentration on one vendor.

Lift: the plan

Every remedial line in this deck moves one of these gauges — and most of them pay for themselves.

Engine scores are deterministic rule-based calibration values; the projected score assumes full quick-win + migration delivery. Formal ISO/IEC 27001 gap percentages live in §8 of the written report.

I
Act One

Findings — what the audit surfaced.

Twenty-seven register findings — F-01 to F-27 — risk-scored, POPIA-mapped, scan-evidenced. None are alarmist; every one arrives with its remedy priced.

The registerF-01 → F-09 heat view
Deep divesResidency · Patching · The AWS cliff
People & processEmail security · Identity lifecycle
Dead spendSnipe-IT · Data Warehouse · billing anomaly
Consolidated Register

Nine findings, one heat map.

ID
Domain
Finding
RYG
Prio
POPIA
F-24
IAM / root
Root key + all 6 IAM users without MFA (0/6); dormant & vendor accounts still enabled; keys aged 1,374–1,633 d — console-confirmed 20 Jul
RED
P1
C7
F-28
Identity / Azure
Azure Entra ID shows 1,000+ user objects vs ~200 mailboxes — stale/guest/duplicate sprawl, unMFA'd, licence & POPIA exposure
RED
P1
C7 · C8
F-29
AI / POPIA
CHOMI (GBV bot) on Botpress cloud + offshore LLM — special PI crosses border twice; no operator agreements; “anonymous” vs special-PI mismatch
RED
P1
§72·C7·C8
F-23
Cloud logging
CloudTrail disabled in all 18 regions; no Config or GuardDuty — no record of API activity
RED
P1
C7 · §22
F-25
Network
Internet-open security groups (0.0.0.0/0) on the sync and enrolment tiers
RED
P1
C7
F-26
Data exposure
S3 bucket “shoutitnow-hosted-content” publicly accessible via bucket policy
AMBER
P2
C7
F-04
Email security
Phishing exposure — risk of not all employees covered
RED
P1
C7
F-07
Cost / licence
AWS commitment expires Sep-2026 — R9k/mo can spike to R60–70k/mo (with F-06 cost exposure)
AMBER
P1
—
F-27
Resilience
Clinical RDS (sn-sql-db-01) is Single-AZ — no automatic failover on the hub database
AMBER
P2
C7
F-02
Vendor custody
Supplier / developer concentration on the clinical core — active knowledge loss underway
AMBER
P1
C7
F-09
Finance
Finance systems not fully integrated — five parallel tools, no single ledger (with F-10 Sage V9 EOL)
AMBER
P2
—
F-03
Identity
HR → IT joiner/mover/leaver gap — 4 of 6 IAM users dormant yet enabled (incl. external vendor, 1,012 d); orphaned access confirmed
AMBER
P2
C7
F-17
Cloud / POPIA
Residency CONFIRMED — clinical DB in af-south-1 (30 Jun 2026); §72 closed. Residuals: SNowI 2 store · eu-west-1 test box
GREEN
✓
§72

Numbering and RYG per the consolidated Final Report Phase 1 v3 register (F-01→F-27), plus F-28 (Entra sprawl) added from the 20 Jul console review. Residency (F-17) confirmed by the AWS configuration scan — Trusted Advisor evidence, 30 Jun 2026. Selection above: the board-relevant lines.

Finding F-17 · GREEN · confirmed by scan, 30 Jun 2026

Residency: confirmed in-country.
The scan found the real fires instead.

af-south-1 · Cape Town§72 closed — primary dataset2 residuals open

Confirmed: the AWS configuration scan verified the SMART 2.0 clinical database (sn-sql-db-01) is hosted in af-south-1 (Cape Town) — with all S3 buckets and primary compute in-country. The previously drafted cross-border concern is resolved: rated GREEN.

Residuals to close: verify the SNowI 2 data store (the account holds a single RDS instance) — and the eLearning/Moodle test instance in eu-west-1 (Ireland), now confirmed live and billing every month on the account’s own cost explorer (console check, 20 Jul 2026). Verify it holds no personal information, evidence the check, then terminate or re-home it to af-south-1 / the cluster.

Governance intact: special-PI scope (F-18), minors & the Children’s Act (F-19), HPCSA (F-20), operator agreements (F-21) and funder mapping (F-22) remain the compliance workstream around this now-resident data.

What the same scan surfaced

  • F-23 — CloudTrail disabled in all 18 regions; no Config, no GuardDuty. Nobody would see a breach.
  • F-24 — root access key in use, no MFA, unrotated keys.
  • F-25 — security groups open to 0.0.0.0/0 on the sync & enrolment tiers.
  • F-26 — S3 bucket shoutitnow-hosted-content public via bucket policy. F-27 — clinical RDS Single-AZ, no failover.

Quick win (§7.1): enable multi-region CloudTrail + Config + GuardDuty, retire the root key, close the security groups, fix the bucket policy — days, not months. The intranet design answers F-27 with its HA database pair.

Evidence: AWS Trusted Advisor “CloudTrail Management Events Logging” — 18/18 regions Red (30 Jun 2026); AWS configuration scan per Final Report Phase 1 v3, §F-17 / F-23–F-27. Live console check (20 Jul 2026): EC2 cost explorer shows exactly two active regions — af-south-1 + eu-west-1 (≈$9–10/mo, persistent 6 months; e.g. Mar-26: $30.27 / $9.37) — and zero EC2 resources in us-east-1. EC2 6-month total $231.58; the material AWS spend sits in RDS & allied services, reinforcing the right-size / exit case.

Maintenance model · feeds F-02 (supplier concentration) & F-06 (AWS cost)

The clinical core has had no maintenance cadence —
for roughly 18 months.

No patch cadence ~18 monthsRuntime reported EOL — verify at handoverReactive-only maintenance

Observed (working notes): patching on SMART 2.0 has been effectively absent for ~18 months, with the runtime reported at end-of-life — exact version to be verified during code handover. The mobile-clinic sync layer is maintained reactively by two individuals, with no vendor SLA on the most critical integration in the estate (ties F-02).

Why it matters: every unpatched month widens the exploit window on a system holding special personal information. Combined with no centralised logging, a breach could run undetected — and POPIA §22 notification deadlines would be missed.

Root cause: not negligence — economics. Patching was priced per-incident by an external vendor. The estate needs maintenance as a service with a cadence, not a favour.

Remedy — maintenance by design

  • Ionity managed hosting includes it: monthly patch cadence, staged QA→live, rollback discipline — inside the flat fee (Act III).
  • Now: snapshot + isolate the current instance; schedule the runtime upgrade into the migration window so it is done once, properly.
  • Custody: progress the code review & clean handover from the external developer (F-02) in parallel — and verify the runtime version there.
Findings F-06 & F-07 · The ones that gate the money

September 2026: the AWS bill
can jump from R9k to R60–70k a month.

R70kR40kR10k Q3-25Q1-26Jul-26Sep-262027 → committed rate ≈ R9k–17.7k/mo on-demand: R60–70k/mo Ionity intranet: R7.95k/mo commitment expires

This is what pricing volatility looks like

The rate you pay is a temporary discount, not a price. When the commitment lapses, the same servers cost 7–8× more overnight — in USD, at the rand's mercy. The exact commitment type (Savings Plan / RI / EDP) is still unconfirmed by AWS — the bill's own paperwork is uncertain.

Exposure & the exit

Do nothing: up to ≈ R630k/yr of new exposure. Renew: locked into another cycle of the same game — with the posture gaps (F-23–F-27) still your own labour. Exit to Ionity intranet before the window closes: the cliff simply never happens — and the September date becomes your leverage, not your deadline.

Recorded baseline: SMART 2.0 AWS ≈ R9k/mo infra; blended AWS-linked run-rate ≈ R213k/yr (cost model, F-07-gated). Spike range from audit minutes: R60–70k/mo on-demand equivalent. Console-verified 20 Jul 2026: the account bills $529.38/mo avg (Cost Explorer, Jan–Jun 2026) — the committed-rate line is real. ZAR figures indicative; USD-billed services carry FX risk on top.

Findings F-04 & F-03 · the human seams

160 unguarded mailboxes.
Accounts that outlive their owners.

F-04 — Email security gap RED · live phishing observed

Email-security licensing leaves a coverage gap — the risk of not all employees covered. Live phishing exposure was observed during the audit. Every unprotected mailbox is a doorway to the estate — and to funder trust.

Protected~40 mailboxes
20%
Exposed~160 mailboxes
80%

Fix: verify exact licence counts → true-up or right-size · enforce MFA everywhere · phishing-drill the organisation. Cost-neutral to modest; risk removal is immediate.

F-03 — Identity lifecycle gap AMBER · C7

No automated joiner-mover-leaver flow between HR and IT. Departed developers built or held SNowI 2, CHOMI and iShout — some credentials were never rotated; a password-protected credentials file sat unopened during the audit.

  • Rotate every key touched by departed staff / vendors — this week, zero cost
  • Wire HR events → Azure AD (retained estate) for automated deprovisioning
  • Individual, logged accounts on SSRS — retire the shared-credential login
Findings F-24 & F-03 · live IAM console capture, 20 Jul 2026

Six users. Zero MFA.
Keys older than the clinic vans.

IAM user
MFA
Last activity
Password age
Active key age
Status
ficky.mathebulaeLearning developer
✗ none
never
1376 d
1376 d · unused
key live
gareth.chandler@int32.co.zaexternal vendor (int32 · MojaMind)
✗ none
1012 d
1630 d
—
vendor · enabled
pierre.vanpapendorpfinance
✗ none
1515 d
1516 d
—
dormant
takudzwa.mabande—
✗ none
1322 d
1633 d
1633 d · unused
dormant · key live
gino.janari—
✗ none
292 d
1633 d
—
dormant
neetin.dayaIT operations · active admin
✗ none
19 min ago
849 d
1374 d
active · no MFA

0 / 6 MFA

Not one account — including the active IT-operations admin — carries multi-factor. A single phished password is full console access to the clinical estate.

4 dormant, still enabled

Four users idle 292–1,515 days, all still console-enabled — including an external vendor (int32) untouched for 1,012 days. Textbook F-03 orphaned access.

Keys never rotated

Active access keys aged 1,374–1,633 days; two never used once — standing secrets that only widen the blast radius. Retire on sight.

Fix — this week, zero cost: enforce MFA on all six (start with the live admin) · disable the four dormant users & the vendor account · delete the three unused/ancient access keys · then wire HR→Azure AD joiner-mover-leaver so this never re-accumulates (F-03).

Source: live IAM console, account 334982276367, captured 20 Jul 2026 — full table archived in the repository (group 10, IAM CSV). Confirms F-24 (IAM hardening) and F-03 (identity lifecycle) at user level, alongside the root-key finding.

New finding F-28 · RED · Azure Entra ID · console-observed 20 Jul 2026

1,000+ Entra identities.
~200 mailboxes. Who are the rest?

The gap

Azure Entra ID shows over 1,000 user objects — against roughly 200 real mailboxes. That is a 5:1 ratio of identities to people. Each object is a login that can be phished, licensed, or abused — and on an estate with no MFA (F-24) and no logging (F-23), most of them are invisible.

What 800 extra identities usually are

  • Stale leavers never deprovisioned (ties F-03)
  • Guest / external accounts from years of sharing
  • Duplicate & test identities, service accounts
  • Bulk-imported client records living in the directory

Attack surface

1,000+ logins, none MFA-protected, is 1,000+ front doors into the retained cloud — the platform we keep must be the clean one.

Licence & cost

Entra P1/P2 and M365 bill per identity. Hundreds of dead objects can mean thousands of rand/mo in phantom licences — a saving hiding in the directory.

POPIA

If client personal data sits as directory objects, that is special PI in an identity store — Condition 7 & retention (C8) exposure, not just IT hygiene.

Fix: export the full Entra user list · classify (active / leaver / guest / service / client-record) · disable then delete the dead · reclaim licences · enforce MFA + Conditional Access on what remains · make Entra the clean identity spine for the whole estate (feeds F-03 automation).

Console-observed 20 Jul 2026 (exact count to confirm on export). Against ~200 mailboxes (M365 profile) this is material identity sprawl — logged as F-28, RED, POPIA C7 · C8. Sits alongside F-24 (no MFA) and F-23 (no logging) as the identity-and-visibility cluster.

New finding F-29 · RED · POPIA §72 · C7 · C8 · special PI

Survivor conversations,
crossing the border twice.

GBV survivorsspecial PIBotpress cloud · not SA

Observed: CHOMI — the GBV support chatbot — runs on Botpress cloud (confirmed not Azure, not SA-hosted). Its analytics dashboard shows live LLM calls on real traffic. Every survivor message therefore leaves the country twice: once to Botpress, once to the LLM provider.

The gap: the compliance questionnaire classes GBV data as special personal information — yet CHOMI's snapshot still reads “anonymous / minimal PII”. The FreshService handoff carries name + cell + location, re-identifying an otherwise anonymous survivor.

Custody: built by a departed external developer (Andrew Moore); a credential/password update is still outstanding.

0
users last month
0
sessions last month
0
bot messages
0
user messages — all LLM-processed offshore

Remedy

Operator agreements (POPIA S.20/21) with Botpress and the LLM provider · reconcile the “anonymous” classification to special PI · set retention/destruction on conversation logs · rotate the departed-dev credentials · then execute the recorded direction — move CHOMI to an AI/RAG bot on SA-resident / edge hosting (Ionity intranet + local LLM) so survivor data never leaves the country.

Botpress analytics captured 20 Jul 2026 (repo group 12). Platform confirmed on Botpress cloud per the 19 Jun 2026 platform-decision meeting; special-PI classification per the compliance questionnaire. Logged F-29, RED.

Findings F-09 · F-02 & register observations — structure

Four quiet findings that compound daily.

F-09 · Five finance systems, zero single ledger AMBER · with F-10 Sage EOL

Sage Evolution V9 (EOL-bound), Fusion, CaseWare, S-Cubed and BioSyn run in parallel. Every hand-off is a manual reconciliation point — audit risk, SARS risk, grant-report risk. Remedy: one backbone — Dynamics 365 (NGO ~60% discount) weighed against a Sage upgrade; retain S-Cube; 3/6/9-month staged cut-over.

The sync layer no one owns observed · ties F-02 · F-25

Mobile-clinic offline sync (Symmetric-DS pattern) is fragile and unsupported — kept alive reactively by two people, no SLA. It is the artery between field vehicles and the clinical record. Remedy: a dedicated, monitored SYNC node with health-checks is designed into the Ionity intranet cluster (Act III).

F-02 · Supplier concentration — active knowledge loss AMBER · P1

The clinical core depends on one external developer at ~R350k/yr all-in; SNowI's builder has left; iShout's handover is incomplete; the Data Warehouse supplier went bankrupt. Remedy: code review → escrow → clean handover, then maintenance under contract cadence — dependency reduction as a formal work-stream.

Duplicate clients on special PI register observation

Duplicate client records previously needed a dedicated merge team; fingerprint verification on tablets was bypassed under server load. Data quality on clinical records is a POPIA C3 accuracy duty. Remedy: unified client identity across SMART 2.0 / SNowI / iShout; restore biometric verify capacity on the new nodes.

The dormant estate

Two systems paid for, switched off —
and a bill that reads zero.

Snipe-IT F-11 · dormant

Azure-hosted asset register: licensed at R6,000/mo (R72k/yr), recorded “Active”, not used. No database access — the register can't be recovered from source; the real asset list lives in a manually-updated Excel file.

Recover access → migrate register into the finance system → decommission. R72k/yr reclaimed; Finance finally sees its own assets.

Data Warehouse F-12 · never live

Planned central integration DB on Azure at R5,000/mo (R60k/yr) — never reached production. Supplier (GCT) reported bankrupt, all staff resigned, nobody holds working knowledge. Platform sits paused.

Retire. Point Power BI directly at source databases now; DOME (Phase 2) inherits the integration role. R60k/yr reclaimed.

Azure billing anomaly F-08 · investigate

After a payment disruption and a Microsoft write-off, Azure invoices now read zero. That is not a discount — it is an unquantified liability and a service-continuity risk on the platform we are about to keep.

Regularise before migrating anything in. Confirm the true billing position with Microsoft; move the tenant onto a clean subscription under the retained-Azure plan.

Together: R132,000/yr of pure dead spend — the lowest-hanging fruit in the estate. No user is disrupted; nothing of value is lost.

Deeper pass · findings the first sweep under-weighted

Five more that earn their place on the register.

Two 2-day outages availability

The estate took two separate two-day outages — clinical service delivery in the field stops when SMART 2.0 is down. No documented RTO/RPO, no tested restore. The Single-AZ RDS (F-27) means the next one is a matter of when. Fix: HA database pair + restore drills, built into the cluster.

Website audit — open items SIN-WEB-2026

A dedicated website audit (SIN-WEB-2026-R01) ran in parallel: performance, SEO and security items outstanding on the public site — the organisation's front door to funders and beneficiaries. Fix: close the R01 action list; fold hosting into the managed estate.

Payroll = single point of failure funder-critical

Payroll depends on one person; T&A integration pending; the finance stack auto-assembles IRP5 / EMP501 / UI19 — statutory filings with no bus-factor cover. Fix: cross-training underway; document & integrate S-Cube; confirm the BioSyn API.

Governance & records gaps POPIA · audit trail

~20 auto-transcribed meetings captured empty; operator/processor agreements and data-classification schedules incomplete; SSRS on shared credentials. Decisions and data-handling aren't consistently evidenced. Fix: QMS & records discipline in Phase 2.

Also on the watch-list

Salesforce paying for a full CRM used only for lead capture · Consumate / ASQ / Eduvoss / Baseline internal tools unmapped for integration · departed vendors (Garrett · Peter · GCT) still hold code or knowledge · fingerprint verification bypassed on tablets under server load. Each carries a remedy in the written register.

Sourced from the master summary, meeting minutes (Jun–Jul 2026), website audit SIN-WEB-2026 and the finance internal audit. Full write-ups & IDs in the consolidated report §5–6.

II
Act Two

The Money — gains, itemised.

Where the R620k goes today, the fruit hanging lowest, the full gains ledger, and the run-rate this estate should land on. Every rand traceable to a finding.

Spend mapR620k, system by system
Low-hanging fruitNine picks, effort-rated
Gains ledger≈ R335k+/yr recurring
TrajectoryRun-rate · payback · 3-year view
Spend Map — recorded annual costs

Where the ~R1.2m goes today.

SMART 2.0 all-inAWS infra + external vendor · clinical hub
≈ R350k/yr
iShoutAWS · AGYW app · handover incomplete
R96k/yr
Snipe-ITAzure · asset register · DORMANT
R72k/yr
Sage Evolution V9finance core · 7 users · outsourced VM
R70k/yr
Data WarehouseAzure · never implemented · DORMANT
R60k/yr
CHOMIBotPress · GBV chatbot · 4 languages
R54k/yr
SSRS reportingAfrihost-hosted · shared credentials
R36k/yr
Fusionprocurement / DoA control · 10 users
R24k/yr
MojaMindrides shared SMART 2.0 RDS · R7k/mo recorded
R18–84k/yr*
Microsoft 365~200 mailboxes · Entra · Mimecast
≈ R132k/yr
Payroll & T&AS-Cube · BioSyn · SPOF
≈ R55k/yr*
Azure + Salesforce + connectivityretained cloud · leads · Afrihost · lines
≈ R90k/yr*
FreshService + internal opshelpdesk · Consumate · ASQ · Eduvoss
≈ R56k/yr

Profiled systems total ≈R856k/yr; adding M365 (~R132k), payroll, Azure, Salesforce & connectivity brings the full IT run-rate to ≈R1.2m/yr. *Estimated where the register left the field uncaptured. MojaMind carried at R7k/mo. gold = dormant spend. AWS-linked hosting baseline within these lines ≈ R213k/yr.

Console evidence — Cost Explorer, Jan–Jun 2026 · SMART 2.0 account

The real bill: $529 a month.
Seventy percent of it is plumbing.

Support (Business)premium plan — see card →
$100.00/mo
RDSsn-sql-db-01 · Single-AZ (F-27)
$86.70/mo
Elastic Load Balancingalways-on front plumbing
$83.45/mo
Tax (VAT)shrinks with the bill
$69.05/mo
EC2-OtherEBS volumes · snapshots · transfer
$58.61/mo
VPCNAT gateways — silent burners
$57.96/mo
EC2-Instancesthe actual compute — tiny
$38.48/mo
ECS + S3 + Secretscontainers · storage · 1 secret
$35.13/mo
CloudWatchobservability — unfunded
$0.00

Plumbing vs workload

≈ $369/mo (~70%) is overhead — support plan, load balancing, NAT, volumes, VAT. The workload itself (DB + compute + containers + storage) is ≈ $160/mo. The bill proves the sizing case: this estate is micro-computing-sized.

Premium support, zero eyes

$100/mo for Business Support next to $0.00 CloudWatch across six months — F-23 rendered in currency: paying for help, funding no sight. Downgrade candidate today, before any migration.

The register, validated

$529.38/mo ≈ R9.5k/mo (~R114k/yr) at prevailing rates — within FX noise of the recorded ~R9k/mo. Add iShout’s ~R8k/mo line and the estate AWS baseline of ≈R213k/yr reconciles from live data.

Trim now, pre-migration: downgrade the support plan (−$100/mo) · retire the eu-west-1 box (−~$10/mo) · review the LB/NAT pair (part of −$141/mo) → ≈ R2.5–3.5k/mo back immediately, before a single workload moves.

Source: live Cost Explorer, account 334982276367 — total $3,176.26 over Jan–Jun 2026, avg $529.38/mo, 16 services (captured 20 Jul 2026). Full table archived in the repository — group 10, CSV + evidence note. ZAR conversions indicative (~R18/$).

Low-Hanging Fruit — pick in the next 90 days

Nine picks. No ladders required.

R72k/yr
Decommission Snipe-IT

Recover access → migrate the asset register into the finance system → switch off. Finance gains its single source of truth.

effort low · owner IT + Finance
R60k/yr
Retire the Data Warehouse

Never reached production; supplier defunct. Direct Power BI links to sources now; DOME absorbs the role in Phase 2.

effort low · owner IT + M&E
≈R30k/yr
Right-size the shared RDS

MojaMind rides the large clinical database instance with a tiny footprint. Split to a right-sized instance — the cleanest infra saving pre-exit.

effort low · interim (absorbed by exit)
≈R50k/yr
Consolidate finance licences

Dynamics 365 at NGO ~60% discount (~R20k/yr, 4 users) vs Sage V9 + add-ons ≈ R94k. Net after cut-over, with S-Cube retained.

effort medium · 3/6/9-month staged
R36k/yr
Fold SSRS into the cluster

Reporting moves to the intranet reporting node with individual, logged accounts — retiring the Afrihost line and the shared login (F-SSRS-ACC).

effort low · with migration
R0 · risk↓
Rotate departed-dev keys

Every credential touched by former developers and the bankrupt supplier — rotated this week. The cheapest security win in the estate.

effort trivial · do first
value ↑
Activate the eLearning platform

Built, paid for, dormant. Integrate into iShout per plan — a funded deliverable switched on for free.

effort low · owner programmes
reach ↑
Re-enable iShout DataFree

A data-free app whose zero-rating is disabled undercuts its whole purpose for AGYW users. Confirm cause; restore in the action plan.

effort low · equity win
risk ↓↓
Close the mailbox gap

True-up email security across all ~200 mailboxes; MFA everywhere. Modest licence cost buys the largest single risk reduction available.

effort low · this month
The Gains Ledger — recurring, annual

Every line traceable to a finding.

#ActionSourceAnnual gain
G-1Exit AWS → Ionity Private Intranet (CLINICAL tier, all AWS workloads)F-06 · F-07 · F-23–F-27+ R117,600
G-2Decommission Snipe-IT; asset register into financeF-11+ R72,000
G-3Retire Data Warehouse; direct Power BI source linksF-12+ R60,000
G-4Finance consolidation — D365 NGO pricing vs Sage V9 stack (net)F-09 · F-10+ R50,000
G-5SSRS folded into intranet reporting node (Afrihost line retired)F-SSRS+ R36,000
G-6Shared-RDS right-size (interim until exit completes)§7.5+ R30,000*
G-7Email-security true-up to ~200 mailboxes (risk closure)F-04− cost-neutral
Identified recurring gains — before Phase-3 vendor-dependency savings≈ R335,600 / yr

+ Risk avoided

AWS commitment cliff never fires: up to ≈ R630k/yr exposure removed (F-04).

+ Phase-3 upside

Clinical-vendor dependency reduction after code handover — further recurring saving inside the ~R350k all-in line (F-08).

− One-off costs

Cluster CAPEX R118,500 · migration labour (Ionity-absorbed up to R25k on Azure-bound moves) · D365 onboarding.

*G-6 is interim and largely absorbed into G-1 once the exit completes — totals conservatively count it once. Figures indicative, from recorded register costs; vendor confirmations at sign-off.

Trajectory

From R1.2m to a ~R865k run-rate.

Todayfull IT run-rate · fragmented · dual-cloud
≈ R1.2m / yr
+ 90 daysdormant spend off · RDS & support right-sized
≈ R1.06m / yr
+ 6 monthsAWS exited → Ionity intranet · SSRS folded
≈ R950k / yr
+ 9–12 monthsfinance consolidated · Entra & licences right-sized
≈ R865k / yr
−0%
total IT run-rate cut (≈54% of the poor-value portion) at plan completion
R0k+
recurring annual gains — the ledger, banked
0
clinic-days of downtime budgeted for the entire programme

Baseline ≈R1.2m/yr total IT run-rate (summed system costs); the ≈R335k/yr gains land it near R865k. Poor-value portion specifically falls R620k→~R285k. Excludes one-off cluster CAPEX & Phase-2 build investments (scoped separately).

Payback & the three-year picture — AWS workloads only

One year to payback.
Then it's all gain.

R2.4mR1.6mR800kR0 Year 1Year 2Year 3 break-even ≈ month 12 AWS on-demand: up to R2.34m AWS renewed: R639k Ionity: R405k all-in
3-year totalsCost
Ionity intranet — R118.5k CAPEX + 36 × R7,950R404,700
AWS — commitment renewed at today's blendR639,000
AWS — commitment lapses (R65k/mo avg)R2,340,000
Ionity advantage — vs renewed / vs lapsedR234k / R1.94m

Payback arithmetic

R118,500 CAPEX ÷ (R213k − R95.4k)/yr
= ≈ 12.1 months vs today's AWS
= ≈ 2 months vs the lapsed-commitment rate

Comparison covers AWS-hosted workloads only (SMART 2.0 · SNowI 2 · iShout · eLearning · MojaMind share). Ionity line includes managed service, patching, monitoring & backups; hardware refresh reserve included from year 4. FX risk sits only on the AWS lines.

III
Act Three

The AWS Exit — and the Ionity Private Intranet.

Why the estate leaves AWS entirely, what it moves onto — sovereign micro-computing nodes on your own floor — what that costs, what Azure keeps carrying, and the alternatives weighed honestly beside it.

The caseVolatile pricing · residency · custody
The destinationNode cluster, drawn & priced
The forecastHosting all AWS workloads
The optionsFive paths, one recommendation
The Case for Exit

Four reasons AWS is the wrong home for this estate.

Volatile pricing

Your rate is a commitment artefact, not a price. Sep-2026: R9k → R60–70k/mo if it lapses — and the commitment's own type/expiry couldn't be confirmed during the audit. Billed in USD, exposed to every rand move.

Unguarded perimeter

The 30-Jun scan: CloudTrail dark in 18/18 regions, root key without MFA, security groups open to 0.0.0.0/0, a public S3 bucket (F-23–F-26). Residency checked out — the guardrails around it did not.

Custody & control

The environment is administered through one external vendor relationship (F-08), unpatched for 18 months (F-06). You rent the floor and outsource the keys.

Oversized for the load

The workloads are basic and scattered — a .NET app, a CRM, two content apps, one modest database. Hyperscale elasticity is being paid for; none of it is being used.

The principle

This estate doesn't need a hyperscaler — it needs sovereignty, a patch cadence, and a predictable rand-denominated bill. Own the compute, contract the care. That is precisely what private intranet hosting on micro-computing delivers — next page, drawn to the node.

Exit Inventory

Everything AWS hosts today — and where it lands.

Workload
On AWS today
Destination
SMART 2.0 clinical hub · QA + live · app + RDScritical
App + DB confirmed af-south-1; clinical RDS sn-sql-db-01 Single-AZ — no failover (F-27); fingerprint verify bypassed under load; ~R9k/mo infra.
Ionity intranet — APP + HA DB pair (answers F-27), dedicated SYNC node, biometric capacity restored. Sovereignty by design.
SNowI 2 follow-up CRM · WhatsApp channelcritical
Shares SMART 2.0 environment; departed internal developer; near-real-time referral feed.
Ionity intranet — co-located with the hub it feeds from; credentials rotated during cut-over.
iShout AGYW membership app · R8k/mohigh
AWS-hosted; handover from F-Links/Afrolynx incomplete; DataFree disabled.
Ionity intranet — APP node + public edge via gateway; DataFree re-enabled in the action plan.
eLearning built, dormant · rides SMART 2.0 AWSlow
Complete but unused; inherits SMART 2.0's posture; its Moodle test box runs live in eu-west-1 — billing ~$10/mo, every month (F-17 residual: verify no PI, then kill or re-home).
Ionity intranet — activated on the APP node and integrated into iShout. Paid-for value, switched on.
MojaMind e-art mental-health · pre-go-livesensitive
Rides the shared clinical RDS with a tiny footprint; register already plans an Azure move.
Azure (retained estate) — per its own plan, inside the R25k absorption barrier; joint SU governance kept intact.

Five workloads. One shared environment. One coordinated exit — the hub-and-spoke coupling that made AWS risky makes leaving it simple.

Recommendation R-01 · Ionity Global

Host it yourselves —
we'll run it with you.

Move every AWS workload onto a Private Intranet cluster of micro-computing nodes, installed on Shout-It-Now premises, owned by Shout-It-Now, operated under an Ionity managed-service cadence. Clinical data never leaves the building except by your policy. The bill is flat, in rand, forever indifferent to commitment expiry dates.

R118.5k
once-off — 8-node CLINICAL cluster, installed & hardened
R7,950
per month, flat — managed hosting, patching, monitoring, backups
−55%
vs today's AWS run-rate · payback ≈ 12 months
100%
sovereignty — residency stays in-country by architecture, with logging & HA failover built in (F-23 · F-27 closed)

Building Tomorrow, Today — on hardware you can point at.

Ionity Private Intranet — CLINICAL tier topology

Eight nodes. One living organism.

MOBILE CLINICS · FIELD AZURE · M365 (RETAINED) GATE-1 · EDGE firewall · WireGuard · LTE failover 2.5G MANAGED SPINE · PoE · VLAN-SEGMENTED APP-1 SMART 2.0 web · QA→live 16GB · NVMe · ARM64 APP-2 SNowI 2 · iShout · eLearning 16GB · NVMe · ARM64 DB-1 · PRIMARY clinical DB · encrypted at rest NVMe mirror · PITR DB-2 · REPLICA hot standby · read reports auto-failover SYNC-1 mobile-clinic sync · health-checked owned, monitored sync layer RPT-1 SSRS successor · Power BI feeds individual, logged access BAK-1 immutable snapshots · 3-2-1 restore-tested monthly MON-1 telemetry · alerts · IR runbook POPIA §22-ready logging DUAL UPS · SURGE · 5V/20W-CLASS NODES — THE WHOLE CLUSTER DRAWS LESS THAN A KETTLE

Topology: CLINICAL tier (recommended). Every node is a discrete micro-computer — a failure replaces a R12k part, not a platform. AI-M (Ionity's 5V/20W intelligent motherboard, Q2-2026 line) slots in as nodes refresh.

CAPEX — Bill of Materials, CLINICAL tier

Own the metal for R118,500, once.

ItemSpecCost (ZAR)
GATE-1Edge gateway — firewall, WireGuard, VLANs, LTE failover modem9,800
APP-1 · APP-22 × application nodes — 16GB ARM64, NVMe, active cooling22,400
DB-1 · DB-22 × database nodes — NVMe mirrored pairs, ECC-class storage path26,800
SYNC-1Mobile-clinic sync node — queue + health-check stack11,200
RPT-1Reporting node — SSRS successor, Power BI gateway7,900
BAK-1 + MON-1Backup node (immutable, 3-2-1) + monitoring/telemetry node12,600
NET2.5G managed PoE spine switch + structured cabling6,400
PWRDual UPS, surge protection, LTE data contract setup14,800
BUILDRack/enclosure, assembly, hardening, burn-in, documentation6,600
CLINICAL cluster — installed, hardened, handed overR118,500

Why micro-computing wins here

The whole AWS estate fits in comfortably: a .NET app, a CRM, two content apps, one modest DB. Distributed small nodes give graceful failure (one node ≠ the estate), silent 5V/20W-class power draw, and rand-priced replacement parts on a shelf.

Owned, not rented

Hardware title vests in Shout-It-Now on commissioning. If the Ionity relationship ever ended, the cluster — and every byte on it — stays put. That is the opposite of vendor lock-in (F-08's lesson, applied).

Refresh reality

Node-by-node refresh from year 4, ≈ R15–20k/yr reserve — already inside the managed fee. AI-M boards adopt as they ship.

Ionity Managed Hosting — monthly, flat, in rand

Three tiers. One promise: no cliffs.

CORE
R4,950/mo
R68,500 once-off · 4 nodes
  • Gateway + app + DB + backup nodes
  • Business-hours monitoring · monthly patch cadence
  • Nightly immutable backups
  • Fits: pilot / non-clinical workloads
Recommended — this estate
CLINICAL
R7,950/mo
R118,500 once-off · 8 nodes · R95,400/yr
  • Full topology: HA database pair + dedicated SYNC & reporting nodes
  • 24/7 monitoring · alerting · IR runbook (POPIA §22-ready)
  • Monthly patching, staged QA→live — the 18-month maintenance gap closed for good
  • Restore-tested backups · PITR · off-site encrypted copy
  • 99.5% availability target · hardware refresh reserve included
SOVEREIGN
R11,900/mo
R186,000 once-off · 12 nodes · dual-site
  • Everything in CLINICAL, mirrored across two premises
  • Encrypted DR replica into the retained Azure estate
  • RPO ≤ 15 min · RTO ≤ 4 h, evidenced for funders
  • Fits: post-Phase-2 scale, DOME era

All tiers: rand-denominated, 12-month terms, no usage metering, no egress fees, no commitment cliffs. Up to 68% maintenance saving vs legacy OEM support models (Ionity engagement benchmark). Local AI / offline LLM node available as an option on CLINICAL and above.

The Forecast — all AWS workloads, re-homed

What hosting everything will actually cost.

AWS — if commitment lapseson-demand, USD-billed · Sep-2026 onward
R60–70k / mo
AWS — commitment renewedblended run-rate today · renewal terms unknown
≈ R17.75k / mo
Ionity CLINICAL — year 1R7,950/mo + CAPEX amortised over 36 mo
≈ R11.24k / mo
Ionity CLINICAL — steady stateflat managed fee, rand-priced, all-inclusive
R7,950 / mo

Annual, steady state

R95,400/yr hosts SMART 2.0, SNowI 2, iShout, eLearning and reporting — vs ≈ R213k on AWS today. −55%.

Everything included

Patching, 24/7 monitoring, backups, restore tests, IR runbook, refresh reserve — items AWS bills as your labour.

Zero volatility

No USD exposure, no egress metering, no renewal roulette. The September 2026 date stops being a threat.

Forecast basis: AWS-linked baseline ≈ R213k/yr, console-verified (SMART 2.0 account: $529.38/mo avg, Jan–Jun 2026); workload sizing from system profiles. MojaMind lands in retained Azure per its own migration plan — its hosting is excluded from both sides of this comparison.

Fit-for-purpose engineering

Built for an organisation that runs on wheels.

Offline-first is your native mode

Mobile clinics already work disconnected and sync when signal returns. A private intranet cluster speaks that language natively — the dedicated SYNC node queues, verifies and reconciles field data with health-checks, replacing the fragile unsupported layer (F-07) with an owned, monitored one.

5V/20W-class nodes — NPC economics

The whole cluster draws less power than a kettle and runs silently through load-shedding on dual UPS + LTE failover. Power, cooling and space costs round to noise — a materially different economic base from rack servers or hyperscale rent.

Edge AI-ready — the AI-M path

Ionity's AI-M intelligent motherboard line (5V/20W True-Edge-AI, 2026) slots into this exact topology: local inference for duplicate-client matching (F-09), sync anomaly detection, even an offline LLM assistant for reporting — all without data leaving the building.

Compliance by architecture

Residency is already in-country (F-17, confirmed) — the cluster keeps it that way by architecture, and adds what the scan found missing: §22-ready logging on MON-1 (vs F-23), an HA database pair (vs F-27), and a closed WireGuard-only perimeter (vs F-25). Funder due-diligence answers itself.

This is Ionity's home ground: IoT-grade hardware, ecosystems architecture, and managed edge intelligence — engineered in Centurion, deployed on your floor.

The Move — engineered, not improvised

Parallel-run migration. Zero clinic-days lost.

Weeks 1–2

Stand up

cluster built off-site
  • Assemble, harden, burn-in
  • Runtime upgraded in transit — maintenance cadence starts
  • WireGuard mesh + VLANs
  • Install on premises · dual UPS
Weeks 3–4

Shadow

AWS stays primary
  • Nightly data replication AWS → DB-1
  • QA environment cut over first
  • Field-vehicle sync tested against SYNC-1
  • Restore drill from BAK-1 — evidenced
Weeks 5–6

Cut over

one weekend window
  • Final delta sync · DNS/endpoint swing
  • Clinics resume Monday — same screens
  • AWS kept warm, read-only, 30 days
  • Credentials rotated estate-wide (F-03)
Weeks 7–8

Decommission

the bill ends
  • AWS snapshots exported to BAK-1
  • Accounts closed before the Sep window
  • MojaMind lands in retained Azure
  • Savings ledger starts counting

Rollback, always

Until decommission day, AWS remains a one-command fallback. No burn-the-boats moments on a clinical estate.

Vendor custody handled

Code review & escrow with the external developer run inside the shadow phase (F-08) — the handover happens while both environments exist.

Fixed-price delivery

Migration labour is quoted fixed at Phase-2 sign-off; Azure-bound moves are absorbed by Ionity up to the R25k barrier.

The Retained Estate — Azure & Microsoft 365

Azure stays — as the backbone, not the bill.

What Azure keeps carrying

M365 is embedded and working — Teams, SharePoint intranet, OneDrive, Outlook, Power BI. The direction is optimise, not migrate: identity (Azure AD) becomes the single sign-on spine for the whole estate, including the intranet cluster.

Azure AD — identity spineM365 productivity Power BI reportingSharePoint intranet Mimecast integrationSOVEREIGN-tier DR replica

What moves into Azure

  • MojaMind — per its own recorded plan; joint Stellenbosch governance preserved; lands before its post-intervention handover.
  • Asset register — out of dormant Snipe-IT, into the finance system on the M365/D365 side.
  • M&E datasets — Data Warehouse role replaced by direct Power BI source links now, DOME later.
  • HR → IT lifecycle automation — joiner/mover/leaver wired through Azure AD (F-03).

The R25,000 absorption barrier

Ionity absorbs migration and configuration costs for Azure-bound moves up to R25,000 — MojaMind's landing, the asset-register fold-in, Power BI re-pointing and lifecycle wiring are executed at no charge to Shout-It-Now within that barrier.

Barrier applies to Azure-destination migrations in this plan; drawn against actual hours at cost; unused balance reported at close-out.

Housekeeping before anything moves

Regularise the zero-reading billing anomaly with Microsoft; verify the ~R55/user NBL licence deal; true-up the email-security mailbox coverage gap. A clean subscription is the condition of the retained estate.

Options on the table — the client decides

Five paths for the AWS workloads.
One recommendation, no blinkers.

A
Ionity Private Intranetmicro-computing cluster on premises — recommended
POPIA by design · flat rand pricing · patching & monitoring included · offline-first sync · hardware owned by Shout
R7,950/mo
+ R118.5k once
Recommended
B
Lift into retained AzureSA North region · single-cloud consolidation
One cloud to govern · R25k absorption applies · but: VM+SQL costs exceed the cluster fee, ZAR-adjusted pricing, billing anomaly must be resolved first
≈ R15–19k/mo
est., usage-metered
Viable
C
Stay on AWS — renew commitmentalready af-south-1 · harden in place
Renewal roulette continues (F-07) · posture fixes F-23–F-27 remain your own labour · custody model unchanged
≈ R11–13k/mo
est. + renewal risk
Partial fix
D
Local SA VPS / colocationcommodity hosting provider
Cheap rent · but DIY ops: no clinical SLA, no patch cadence, no IR runbook — recreates F-06/F-07 with a different logo
≈ R6–9k/mo
excl. ops labour
Not advised
E
SOVEREIGN hybridIonity cluster + encrypted Azure DR replica
Everything in A, plus funder-grade RPO/RTO evidence and dual-site continuity — the natural Phase-2/DOME end-state
R11,900/mo
+ R186k once
Upgrade path

Phase 1 mandate: list the options, price them honestly, and leave the direction with the client (§2.4). Estimates B–D from current SA public price cards at typical sizing; firm quotes on request. A and E are firm Ionity offers valid 90 days.

The honesty slide

What could go wrong — and what's already in place for it.

“On-prem means we carry the fire risk.”

True — mitigated by 3-2-1 backups with an off-site encrypted copy (SOVEREIGN adds a live Azure DR replica), dual UPS, surge protection, and restore drills evidenced monthly. The written DR test replaces AWS's implicit promise with your explicit proof.

“What if Ionity is unavailable?”

Hardware is yours; configs, runbooks and credentials live in your vault, documented to hand-over standard. Any competent engineer can operate the cluster — the anti-F-08 design. Escrowed documentation is a contract term, not a favour.

“Load-shedding and connectivity.”

5V/20W-class nodes ride UPS for hours, not minutes; LTE failover keeps sync and monitoring alive; the estate's own offline-first design (vehicles sync when they can) is preserved — it was built for this country.

“Micro-computers sound small.”

Sized against measured load: the current workloads idle a fraction of one modern ARM64 node. Eight nodes give headroom, HA and growth; DOME-era scale simply adds nodes — R12k a step, not a re-platform.

Net risk position

The exit trades provider risks you can't control (pricing cliffs, FX, jurisdiction, custody) for operational risks you can engineer away — and the engineering is included in the fee. That trade is the audit's central recommendation.

IV
Act Four

Systems Detail — every remedy on record.

The per-system findings and remedies from both tracks, condensed from fourteen profile documents — with the finance consolidation and CHOMI's AI path called out.

Internal trackSage · Fusion · S-Cube · SSRS · Salesforce
Client-facing trackSMART 2.0 · SNowI · CHOMI · iShout · MojaMind
Finance focusOne backbone, staged safely
AI governanceChomi v2 on guardrails
Internal track

The back office: fragmented today, consolidated tomorrow.

System
What we found
Remedy
Sage Evolution V9 finance core · ~R70k/yr · 7 usersend-of-life path
V9 unsuited to dynamic grant reporting; outsourced VM hosting causes speed/connectivity friction; finance landscape fragmented across five tools.
Consolidate: Dynamics 365 (NGO ~60% discount, ~R20k/yr · 4 users) vs Sage 300/Intacct, plus Sage X3 and Sage CRM options — with Sage 300-led consolidation preferred where existing Sage processes can be unified; 3/6/9-month staged cut-over.
Fusion (Neurasoft) procurement / DoA · R24k/yrcoupled decision
Enforces the Delegation-of-Authority spend control — but does not integrate with Sage Intacct; its future is chained to the Sage choice (F-FU-COUPLE).
Decide as one branch of the finance decision; preserve DoA enforcement through any change; review approver matrix currency.
S-Cube / BioSyn payroll & T&ASPOF
Payroll dependent on one person; T&A integration pending; funder-critical process partly manual.
Retain & integrate; cross-training underway removes the single point of failure; confirm the BioSyn API path.
SSRS reporting · Afrihost · R36k/yraccess model
Shared credentials on reports drawn from clinical sources; no data classification recorded on a server that inherits its sources' sensitivity.
Fold into RPT-1 on the intranet cluster: individual Azure AD-tied accounts, access logging, classification inherited from SMART 2.0.
Salesforce lead capture onlyfold in
Used for a sliver of its licence; incomplete field usage blocks reporting value.
Replace / replicate internally within the consolidated stack — no standalone licence for a form.
FreshService helpdesk · R10k/yrkeep
Stable, low-cost, three-field API = low lock-in; renewal date unconfirmed; Chomi tickets can carry GBV-adjacent PII.
Keep; confirm renewal deliberately; align the Chomi ticket flow with POPIA treatment.
Client-facing track

Reach the beneficiary — without the vendor lock-in.

Platform
What we found
Remedy
SMART 2.0 clinical hub · ~R350k/yr all-incritical · lock-in
One external developer at high cost, no completed handover (F-02); maintenance dark ~18 months; Single-AZ clinical RDS (F-27); fingerprint verify bypassed under load.
Code review → escrow → handover; migrate to intranet APP/DB nodes; restore biometric capacity; maintenance under CLINICAL cadence.
SNowI 2 follow-up CRM · Shout-ownedownership risk
Built by a departed internal developer; no recorded support model; rides SMART 2.0's AWS environment.
Secure ownership & document before change; co-migrate with the hub; WhatsApp-primary direction preserved.
CHOMI / AIMEE GBV bot · R54k/yr · BotPresssensitive
Departed external developer; language-count discrepancy (4 vs 7); anonymous-by-design but adjacent ticket flow carries PII.
Secure credentials; advance Chomi v2 (AI-enabled, Option C hybrid) with governance guardrails — next pages.
iShout + eLearning AGYW app · R96k/yr + built-dormanthandover
F-Links/Afrolynx handover incomplete; DataFree disabled undercuts the app's purpose; eLearning complete but unused; ShoutLink dormant ~1 year.
Complete takeover; re-enable DataFree; activate eLearning inside iShout; confirm ShoutLink functions absorbed into SMART 2.0 web.
MojaMind e-art mental health · pre-go-livemost sensitive data
HIV status + mental-health data + potential minors — the estate's most sensitive combination; go-live already slipped; new supplier needed post-launch.
Gate go-live on POPIA basis, ethics & crisis-path readiness; land in retained Azure (R25k barrier); delay contractor handover until the 8–10-week intervention completes.
Finance — the single biggest structural lever

One finance backbone — funder-ready, not fragmented.

Finance lives across Sage, Fusion, CaseWare, S-Cubed and an in-development BioSyn build. The remedy is deliberate consolidation with a safe, staged phase-out — no rip-and-replace — prioritising a Sage 300 consolidation route where feasible, while also evaluating Sage X3 and Sage CRM for broader fit.

Evaluate Dynamics 365 + Sage Stack

NGO sector discount up to ~60% — indicative ~R20k/yr for 4 users vs the Sage V9 estate at R70k + add-ons. Fresh NPO-focused demo agreed; weighed honestly against a Sage 300/Intacct route, with Sage X3 and Sage CRM included in the recommendation matrix.

Retain what works

Keep S-Cube for payroll & T&A — integrate rather than replace; confirm the BioSyn API; keep Fusion's DoA control intact through any change (the Intacct constraint decides its path).

Phase out safely

A 3 / 6 / 9-month staged hand-over retires legacy finance and the on-prem server load without ever interrupting payroll or funder reporting. The asset register (ex-Snipe-IT) arrives as part of the move.

Why it matters financially

Sage Evolution V9 is on borrowed time — replacement is a priority, not a nice-to-have. Consolidation is the largest structural lever on the ~R620k spend: ≈ R50k/yr net licence gain, plus the un-priced but real savings of one reconciliation instead of five (audit fees, close time, error risk — SARS and grant reporting included). Recommendation emphasis: consolidate other Sage 300-related processes first, then extend via Sage X3/Sage CRM only where functional gaps remain.

AI & model governance — Pillar 8

Chomi grows up — with guardrails, not vibes.

Chomi v2 — AI-enabled, Option C hybrid

Advance the GBV companion on the existing BotPress backbone: WhatsApp-first plus a light PWA. Nine content streams, 640+ messages per language, four (target seven) languages — now with AI-assisted conversation depth while keeping the social-work team's best-practice framing: empathy → facts → options.

A survivor's chat is the most sensitive conversation this organisation hosts. v2 is therefore an engineering-governance project, not a chatbot refresh.

The governance frame — applied

  • Model provenance & hosting jurisdiction declared — local/edge inference preferred (AI-M path)
  • Prompt-injection & PII-leakage controls; anonymous-by-design preserved
  • Human-in-the-loop escalation to live services — the “Help Now” path is sacred
  • Conversation logging with retention rules (C3/C8) — evidence without surveillance
  • Reconcile the 4-vs-7 language record before scope-pricing v2

Same frame governs Self Cav / AIMEE and the parallel builds (FLOW women's-health research app; NACOSA-prioritised AI reporting agent) — every AI touchpoint in the estate answers the same eight questions before it ships.

Remedy for F-29 · shorten the sprawl · host the AI locally

From a scripted maze offshore
to one local model + RAG on SA soil.

Today · Botpress (offshore)
WhatsApp user (survivor) Botpress cloud · scripted tree9 streams × 640+ msgs × 4–7 languages ≈ thousands of hand-built nodes Offshore LLMper-call USD · cross-border hop #2 FreshService ticketname + cell + location — re-identifies border ✗ border ✗
Chomi v2 · Ionity edge (SA soil)
WhatsApp user (survivor) Ionity edge · local LLM (AI-M 5V/20W)empathy → facts → options, as a system prompt RAG retrieverthe 640+ vetted messages = knowledge base “Help Now” → human escalationinternal referral · logs stay on-prem ✓ in-country
1
corpus + 1 local model replaces thousands of scripted nodes
1→∞
languages handled by the model — no more 640 msgs per language
0
border crossings — F-29 closed by architecture
R0
marginal LLM cost — local inference, no per-call USD
edit
a document to update — not rebuild a decision tree

How it shortens: the hundreds of hand-built menus and 640+ messages per language become a single retrieval corpus the local model reads at answer-time. Same trauma-informed framing, same “Help Now” path — but no Botpress subscription, no offshore LLM, no cross-border transfer, and maintenance becomes “drop a document in the corpus.” It rides the same Ionity edge node as the clinical exit — one architecture, two problems solved.

Flow reconstructed from the CHOMI system profile (9 streams · 640+ messages/language · menu tree) and the 19 Jun platform-decision note. The Miro “Chomi” board maps the current scripted tree — the corpus this RAG build ingests wholesale, losing nothing.

V
Act Five

The Road Ahead — three phases, two parallel builds.

Delivered
Phase 1

Audit & Advisory

complete — this presentation closes it
  • 21-system baseline & coverage map
  • Findings register F-01→F-27, POPIA-mapped
  • Costed gains ledger & savings case
  • AWS-exit recommendation with alternatives
Decision now
Phase 2

Migrate & Consolidate

weeks 1–8 post sign-off
  • Ionity intranet cluster build & parallel-run migration
  • Azure-bound moves under the R25k barrier
  • DOME consolidation & QMS / security documentation
  • Chomi v2 (AI-enabled) scoped build
Then
Phase 3

Rationalise & Cut

months 3–9
  • Finance cut-over completes (3/6/9 hand-over)
  • Decommission dormant & duplicate systems
  • Vendor-dependency reduction on the clinical core
  • Run-rate lands ≈ R285–320k/yr

Parallel build — FLOW

Women's-health longitudinal research: WhatsApp EMA and/or dedicated Android app. Proposal issued; quotation pending.

Parallel build — AI Reporting Agent

Grant-driven dashboard agent — NACOSA prioritised ahead of Enterprise & Gilead. Data mapping first; phased, scoped quotation follows.

The first 90 days — owners named, fruit picked

Ninety days to a different estate.

Days 1–30 banks R0 · cuts risk

  • Enforce MFA on all 6 IAM users; disable 4 dormant + the int32 vendor account; delete 3 stale access keys (Neetin)
  • Email-security true-up across ~200 mailboxes; MFA enforced (IT)
  • Sign the AWS-exit decision before the Sep-26 window becomes a deadline (Board)
  • Regularise the Azure billing anomaly with Microsoft (Finance + IT)

    • Days 31–60 banks ≈ R132k/yr

  • Snipe-IT: recover access → register into finance → decommission (IT + Pierre)
  • Data Warehouse: retire; Power BI direct source links for M&E (IT + M&E)
  • Cluster stand-up & shadow replication begins (Ionity)
  • Dynamics 365 NPO demo → finance decision table signed (Pierre + Lilian)

    • Days 61–90 banks ≈ R117k/yr more

  • Cut-over weekend: AWS → Ionity intranet; clinics open Monday unchanged (Ionity + IT)
  • MojaMind lands in retained Azure inside the R25k barrier (Ionity)
  • AWS accounts decommissioned; snapshots archived to BAK-1 (Ionity)
  • First monthly patch + restore drill evidenced — the new normal (Ionity)

    • Owner initials per the engagement stakeholder map — Corporate Services (L. Monji), IT Operations (N. Daya), Finance (P. van Papendorp), Ionity delivery (J. van Antwerp, I. Raven).

    Compliance & standards — where the plan lands you

    POPIA answered. ISO 27001 within reach.

    POPIA — condition by condition

    C7 Security
    now
    plan
    §72 Transfer
    now
    plan
    C3 · C8 Data life
    now
    plan
    §22 Notification
    now
    plan

    “Plan” = quick wins + migration + MON-1 logging & IR runbook delivered. §72 already GREEN — residency confirmed af-south-1 (F-17, 30 Jun 2026); the plan clears the residuals (SNowI 2 store · eu-west-1 test box) to 100%.

    ISO/IEC 27001 — the stated objective

    The roadmap is sequenced against Annex A control families: asset inventory (fixed by the register), access control (identity lifecycle + individual logins), ops security (patch cadence), supplier relationships (custody & escrow), incident management (runbook + evidence). Phase-2 QMS documentation makes the readiness programme formal.

    Funders — PEPFAR · Global Fund · HPCSA

    Evidence-first posture: restore drills, access logs, residency attestation and DR metrics become artefacts you can hand over, not claims you make. The SOVEREIGN tier adds evidenced RPO/RTO if funder requirements harden.

    What we need from you

    Five decisions unlock everything.

    #DecisionBy
    D-1AWS exit — approve Option A (Ionity intranet, CLINICAL tier) or select an alternative from the matrixbefore Aug-26
    D-2Finance backbone — Dynamics 365 (NGO) vs Sage 300 consolidation path, with Sage X3 and Sage CRM in the final recommendation matrix after the fresh NPO demo30 days
    D-3Quick-win mandate — Snipe-IT & Data Warehouse decommission, credential rotation, mailbox true-upimmediate
    D-4Phase-2 scope sign-off — migration + DOME + Chomi v2 quotationat sign-off
    D-5Parallel builds — green-light FLOW & the NACOSA AI reporting agent scopingoptional

    The arithmetic of waiting

    Every month of delay costs ≈ R11k in dormant spend alone — and each month closer to September narrows the calm window for a zero-downtime migration. Decided this month, the estate is off AWS with six weeks of margin before the commitment expires.

    The audit is self-funding: the fruit pays for the tree.

    Annex · the reference library

    Evidence Annex — curated client view.

    The complete non-secret audit record is the 485-file SHOUTITNOW-AUDIT-REPO beside this file. This Annex is a directly linked client selection, including the final-workspace supplements and their SHA-256 provenance. Credential files remain held separately (secrets — excluded by design).

    Final Reports & Sign-offPhase 1 v3, ENDHANDIN, SPINE, AI architecture, sign-off, change plan.9 files
    A1C-REPORTShout-It-Now__AUDIT_ENDHANDIN-1-20-July-2026_2 (1) (1).docxDOCX · 9.5 MBCopy of SmartSuite_Recommendation_Ionity.docxDOCX · 375 KBSIN_Change_Management_Plan_v1.docxDOCX · 198 KBShout IT Now AI Platform Technical Architecture Report.docxDOCX · 783 KBShout-It-Now_Final_Report_Phase1_v3.docxDOCX · 2.1 MBShout-It-Now_Final_Report_SPINE_v0.2_Ionity.docxDOCX · 382 KBShout-It-Now_IT-Audit_Report-01.docxDOCX · 27 KBShout-It-Now_Progress_Sign-Off_Sheet_V1.0.docxDOCX · 194 KBSmartSuite_Recommendation_Ionity.docxDOCX · 374 KB
    Finance Internal AuditA1P1F finance audit (docx+pdf), HR↔Finance integration, Sage 300 overview.8 files
    A1P1F-REPORTShout-It-Now_Finance-Internal_AUDIT_Week-17-23-Jun-2026_2 (1) (1).docxDOCX · 9.3 MBA1P1F-REPORTShout-It-Now_Finance-Internal_AUDIT_Week-17-23-Jun-2026_2 (1).docx.pdfPDF · 7.4 MBA1P1F-REPORTShout-It-Now_Finance-Internal_AUDIT_Week-17-23-Jun-2026_2(1).docxDOCX · 7.8 MBA1P1F-REPORTShout-It-Now_Finance-Internal_AUDIT_Week-17-23-Jun-2026_2.docxDOCX · 336 KBA1P1F-REPORTShout-It-Now_Finance-Internal_AUDIT_Week-17-23-Jun-2026_2.pdfPDF · 7.3 MBIONITY_Sage300People_Director_Overview.docxDOCX · 1.7 MBIONITY_Sage300People_Director_Overview.pdfPDF · 1.4 MBIntegration of HR and Finance Systems.pdfPDF · 204 KB
    System ProfilesPer-system assessments — 13 systems.13 files
    CHOMI_System_Profile.docxDOCX · 19 KBData_Warehouse_System_Profile.docxDOCX · 12 KBF-28_Azure_SnipeIT.docxDOCX · 18 KBFreshService_System_Profile.docxDOCX · 12 KBFusion_System_Profile.docxDOCX · 12 KBMicrosoft365_System_Profile.docxDOCX · 12 KBMojaMind_System_Profile.docxDOCX · 13 KBSMART2_System_Profile.docxDOCX · 13 KBSNowi_System_Profile.docxDOCX · 12 KBSSRS_System_Profile.docxDOCX · 11 KBSage_Evolution_System_Profile.docxDOCX · 12 KBeLearning_System_Profile.docxDOCX · 19 KBiShout_System_Profile.docxDOCX · 13 KB
    Assessment & AlternativesSystem Assessment workbook + alternatives + eLearning plan.8 files
    Copy of System_Assessment_Updated_Apr2026 (2).xlsxXLSX · 34 KBFull Systems Alternatives .DOC.docxDOCX · 29 KBFull_Systems_Alternatives_Review (1).docxDOCX · 24 KBSystem Alternative.DOC.docxDOCX · 385 KBSystem_Assessment_Updated_Apr2026 (2).xlsxXLSX · 34 KBSystem_Assessment_Updated_Apr2026.xlsxXLSX · 26 KBSystem_Assessment_Updated_Apr2026v2.xlsxXLSX · 19 KBeLearning Project Plan.xlsxXLSX · 14 KB
    Website AuditSIN-WEB-2026-R01 v1.4 (docx + pdf).2 files
    Shout-It-Now_Website-Audit_SIN-WEB-2026-R01_v1.4.docxDOCX · 1.5 MBShout-It-Now_Website-Audit_SIN-WEB-2026-R01_v1.4.pdfPDF · 697 KB
    Quotations, Scope & EngagementION-QUO-001/002, SOW, scope/methodology, Q004/Q021, tracker.18 files
    2026_S^F1_Ai_compliance (1).docxDOCX · 284 KBION-QUO-SHOUT-2026-001_Quotation_MULTI (3).pdfPDF · 1.7 MBION-QUO-SHOUT-2026-001_Quotation_v4 (1).docxDOCX · 2.5 MBION-QUO-SHOUT-2026-001_Quotation_v4 (3).docxDOCX · 2.5 MBION-QUO-SHOUT-2026-001_Quotation_v5.pdfPDF · 2.8 MBION-QUO-SHOUT-2026-002_Quotation_MULTI_v3 (1).docxDOCX · 1.2 MBIT_Audit_Four_Major_Points-k.docxDOCX · 556 KBIT_Audit_Methodology_Reference_Ionity-Global (1) (5).pdfPDF · 565 KBIT_Audit_Scope_Reference.docxDOCX · 553 KBIT_Audit_Scope_Reference_1.pdfPDF · 175 KBQ004-SHOUT001-Audit001.pdfPDF · 4.5 MBQ021-SN01-AD1-26D.pdfPDF · 7.0 MBQTE-Audit-Questions (2).pdfPDF · 2.5 MBREF_SOW-Original-AUDIT-Phase1.mdMD · 5 KBSCOPE OF WORK_ IT SYSTEM ASSESSMENT_ April 2026 (2).docxDOCX · 19 KBSHOUTIT-NOW_Phase-1_Quotation.docxDOCX · 1.9 MBShoutItNow_ProjectTracker.xlsxXLSX · 19 KBShoutItNow_SOW (1).docxDOCX · 11 KB
    Meeting Reports (ION-MMR) & SummariesION-MMR-01→21 + 8 Word summaries + consolidated.30 files
    01_project_status_checkin_24jun.docxDOCX · 217 KB02_sage300_demo_shoutitnow_22jun.docxDOCX · 219 KB03_sage300_demo_ionity_22jun.docxDOCX · 217 KB04_chomi_proposal_review_22jun.docxDOCX · 218 KB05_womens_health_platform_decision_19jun.docxDOCX · 217 KB06_tech_handover_19jun.docxDOCX · 217 KB07_womens_health_app_scoping_18jun.docxDOCX · 217 KB08_shout_it_assessment_kickoff_17jun.docxDOCX · 217 KBION-MMR-2026-01_Client-Feedback-Meeting.docxDOCX · 11 KBION-MMR-2026-02_Pre-Kickoff-IT-Landscape-Induction.docxDOCX · 12 KBION-MMR-2026-03_Kick-Off-Phase-1-IONET-Assessment.docxDOCX · 12 KBION-MMR-2026-04_Neetin-IT-Audit-Kickoff-Access-Quotation.docxDOCX · 11 KBION-MMR-2026-05_Women-s-Health-App-Scoping-WhatsApp.docxDOCX · 11 KBION-MMR-2026-06_Platform-Decision-Chomi-Botpress.docxDOCX · 11 KBION-MMR-2026-07_Tech-Handover-Code-Access-Credentials.docxDOCX · 11 KBION-MMR-2026-08_GBV-Workflow-15-37.docxDOCX · 11 KBION-MMR-2026-09_Finance-Audit-ENDPOINTS.docxDOCX · 11 KBION-MMR-2026-10_Chomi-WhatsApp-Proposal-Review.docxDOCX · 11 KBION-MMR-2026-11_Sage-300-People-Demo-Ionity-view.docxDOCX · 11 KBION-MMR-2026-12_Sage-300-People-Demo-Shout-It.docxDOCX · 11 KBION-MMR-2026-13_Project-Status-Check-In-Website-Report.docxDOCX · 11 KBION-MMR-2026-14_HR-Payroll-Systems-Discovery-IT-Review.docxDOCX · 11 KBION-MMR-2026-15_Finance-Systems-Audit-Sage-vs-Dynamics.docxDOCX · 11 KBION-MMR-2026-16_IT-Systems-Audit-Progress-Findings-Recommendations.docxDOCX · 11 KBION-MMR-2026-17_Finance-Meeting-3-Dynamics-365.docxDOCX · 11 KBION-MMR-2026-18_AI-Dashboard-Solution-Scoping-NACOSA-Enterprise.docxDOCX · 11 KBION-MMR-2026-19_Week-Plan.docxDOCX · 11 KBION-MMR-2026-20_Check-in-online.docxDOCX · 11 KBION-MMR-2026-21_IRP-Engineering-Plastics-in-person.docxDOCX · 11 KBIonity_Meeting_Report_ShoutItNow_CONSOLIDATED_2026-07-01.docxDOCX · 28 KB
    Meeting Notes (dated)Raw + Gemini transcript notes, Jun–Jul 2026.42 files
    2026-06-02_Client-Feedback-Meeting.mdMD · 7 KB2026-06-12_Pre-Kickoff_Gemini.mdMD · 95 KB2026-06-12_Shout-It-Now_Pre-meeting.mdMD · 6 KB2026-06-15-17_IT-Systems-Review-Summary.mdMD · 5 KB2026-06-15_IONET-Assessment-Kickoff_Summary.mdMD · 3 KB2026-06-15_IT-Systems-Meeting-Notes.mdMD · 62 KB2026-06-15_Kick-Off_Notes-short.mdMD · 1 KB2026-06-15_Kick-Off_Phase1_Gemini.mdMD · 51 KB2026-06-17_08_assessment-kickoff.mdMD · 3 KB2026-06-17_Neetin-IT-Meeting_Gemini.mdMD · 60 KB2026-06-17_Neetin-IT-Meeting_Notes-short.mdMD · 0 KB2026-06-17_Phase1-IT-Audit-Kickoff-Neetin_Access-Quotation-SLA.mdMD · 39 KB2026-06-18_07_womens-health-app-scoping.mdMD · 2 KB2026-06-18_Womens-Health-App-Scoping_WhatsApp-vs-App.mdMD · 16 KB2026-06-19_05_womens-health-platform-decision.mdMD · 3 KB2026-06-19_06_tech-handover.mdMD · 2 KB2026-06-19_Finance-Audit-ENDPOINTS_Gemini.mdMD · 2 KB2026-06-19_Finance-Audit-ENDPOINTS_Notes-short.mdMD · 1 KB2026-06-19_Meeting-1537_Gemini.mdMD · 33 KB2026-06-19_Platform-Decision_Chomi-Botpress.mdMD · 23 KB2026-06-19_Tech-Handover_Code-Access-Credentials.mdMD · 23 KB2026-06-19_Tech-Handover_Meeting-Summary-8pt.mdMD · 5 KB2026-06-22_02_sage300-demo-shoutitnow.mdMD · 6 KB2026-06-22_03_sage300-demo-ionity.mdMD · 3 KB2026-06-22_04_chomi-proposal-review.mdMD · 4 KB2026-06-22_Chomi-WhatsApp-Proposal-Review-Neetin.mdMD · 37 KB2026-06-22_Sage300-Demo-ShoutItNow-NPO.mdMD · 4 KB2026-06-22_Sage300-People-Demo-for-Ionity.mdMD · 8 KB2026-06-22_Sage300-People-Demo_ESS-Payroll-Reporting.mdMD · 52 KB2026-06-22_Sage300-People-Demo_QA-OCR-Biosyn-API.mdMD · 3 KB2026-06-24_01_project-status-checkin.mdMD · 3 KB2026-06-24_HR-Payroll-Systems-Discovery-IT-Review.mdMD · 27 KB2026-06-24_Progress-Report_Phase1-IT-Audit.mdMD · 6 KB2026-06-24_Project-Status-CheckIn_Website-Report-Infra.mdMD · 14 KB2026-06-25_Finance-Systems-Audit_Sage-vs-Dynamics_Summary.mdMD · 1 KB2026-06-26_Finance-Meeting-3_Audit_Dynamics365.mdMD · 2 KB2026-06-26_IT-Systems-Audit-Progress_Findings-Recommendations_Summary.mdMD · 1 KB2026-06-29_AI-Dashboard-Scoping_Meeting-Note-Template.mdMD · 5 KB2026-06-29_AI-Dashboard-Scoping_Meeting-Report-v1.mdMD · 4 KB2026-06-29_AI-Dashboard-Scoping_NACOSA-Enterprise-Gilead_Summary.mdMD · 1 KB2026-06-29_Week-Plan_Gemini.mdMD · 27 KB2026-06-30_Check-in_Gemini.mdMD · 51 KB
    Notion Records & SummariesHub cards, master summary, full inventory, CSVs.14 files
    EVENTS_Notice-Board.mdMD · 4 KBHUB_SUMMARY_Ionity-branded-meeting-summaries.mdMD · 1 KBINVOICE_Shout-It-Now.mdMD · 1 KBMeeting-Ops_Minutes-and-Followups.mdMD · 19 KBREF_About-Shout-It-Now.mdMD · 4 KBREF_IT-Audit-Scope-Reference_Coverage-Map.mdMD · 5 KBREF_Ionity-Shout-Flow-Proposal.mdMD · 1 KBREF_Shout-Flow-Live-Document-v1.mdMD · 2 KBShout-It-Now — Master Summary (Consolidated 2026-07-01).docxDOCX · 11 KB_ALL-MEETINGS_8POINT.mdMD · 21 KB_FULL-INVENTORY.mdMD · 8 KB_MASTER-SUMMARY.mdMD · 7 KBshoutitnow-impact-summary.csvCSV · 0 KBshoutitnow-inventory.csvCSV · 2 KB
    Vendor & Product DocsMimecast/Xcally quotes, DW proposal, product guides.8 files
    Creative Resilience Demo_08042025.pptxPPTX · 13.3 MBQuote-CS-FTLJMKG1YWSF_ Mimecast.pdfPDF · 402 KBSNowi Tech.pptxPPTX · 78 KBSNowi User Guide - V3.0.6 (1).pptxPPTX · 13.8 MBShout it Now - Xcally for Business V1 Signed Proposal.pdfPDF · 249 KBShout it now datawarehouse proposal v3.0.pdfPDF · 613 KBShout.Chomi overview.Feb2024.pdfPDF · 1.5 MBiSHOUT! overview2022.pptxPPTX · 5.4 MB
    FLOW — Women's HealthShout Flow operational research protocol.1 files
    Operational Research Protocol_The Shout Flow Model for Longitudinal Menstrual Health Studies 17 June 2026v2 (1).docxDOCX · 727 KB
    SMART 2.0, AWS & CHOMI EvidenceClinical user guide + live AWS console (cost/IAM/regions) + CHOMI Botpress analytics.6 files
    240227 SMART 2.0_Clinial Management User Guide.pdfPDF · 11.1 MBAWS_Console_Evidence_2026-07-20.mdMD · 0 KBAWS_Cost_and_Usage_SMART2_Jan-Jun-2026.csvCSV · 1 KBAWS_IAM_Users_2026-07-20.csvCSV · 0 KBCHOMI_Botpress_Analytics_2026-07-20.csvCSV · 1 KBCHOMI_Botpress_POPIA_Note_2026-07-20.mdMD · 2 KB
    Ionity TemplateOfficial 2026 document template.1 files
    TEMPLATE_2026_OFFICAL_v1.1 (3) (1).docxDOCX · 367 KB
    Final-Workspace SupplementsSHA-256 traced AI governance, CHOMI issue, and alternatives records.6 files
    IMPORT-MANIFEST.mdMD · provenanceAI Governance Pack — July 2026DOCX · 284 KBAI Governance Pack — June 2026DOCX · 318 KBCHOMI issue logDOCX · 12 KBFull Systems AlternativesDOCX · 29 KBSystem AlternativeDOCX · 385 KB

    Meetings — the engagement record (Jun–Jul 2026)

    2026-06-02Client Feedback MeetingNote ↗
    2026-06-12Pre Kickoff GeminiNote ↗
    2026-06-12Shout It Now Pre meetingNote ↗
    2026-06-1517 IT Systems Review SummaryNote ↗
    2026-06-15IONET Assessment Kickoff SummaryNote ↗
    2026-06-15IT Systems Meeting NotesNote ↗
    2026-06-15Kick Off Notes shortNote ↗
    2026-06-15Kick Off Phase1 GeminiNote ↗
    2026-06-1708 assessment kickoffNote ↗
    2026-06-17Neetin IT Meeting GeminiNote ↗
    2026-06-17Neetin IT Meeting Notes shortNote ↗
    2026-06-17Phase1 IT Audit Kickoff Neetin Access Quotation SLANote ↗
    2026-06-1807 womens health app scopingNote ↗
    2026-06-18Womens Health App Scoping WhatsApp vs AppNote ↗
    2026-06-1905 womens health platform decisionNote ↗
    2026-06-1906 tech handoverNote ↗
    2026-06-19Finance Audit ENDPOINTS GeminiNote ↗
    2026-06-19Finance Audit ENDPOINTS Notes shortNote ↗
    2026-06-19Meeting 1537 GeminiNote ↗
    2026-06-19Platform Decision Chomi BotpressNote ↗
    2026-06-19Tech Handover Code Access CredentialsNote ↗
    2026-06-19Tech Handover Meeting Summary 8ptNote ↗
    2026-06-2202 sage300 demo shoutitnowNote ↗
    2026-06-2203 sage300 demo ionityNote ↗
    2026-06-2204 chomi proposal reviewNote ↗
    2026-06-22Chomi WhatsApp Proposal Review NeetinNote ↗
    2026-06-22Sage300 Demo ShoutItNow NPONote ↗
    2026-06-22Sage300 People Demo for IonityNote ↗
    2026-06-22Sage300 People Demo ESS Payroll ReportingNote ↗
    2026-06-22Sage300 People Demo QA OCR Biosyn APINote ↗
    2026-06-2401 project status checkinNote ↗
    2026-06-24HR Payroll Systems Discovery IT ReviewNote ↗
    2026-06-24Progress Report Phase1 IT AuditNote ↗
    2026-06-24Project Status CheckIn Website Report InfraNote ↗
    2026-06-25Finance Systems Audit Sage vs Dynamics SummaryNote ↗
    2026-06-26Finance Meeting 3 Audit Dynamics365Note ↗
    2026-06-26IT Systems Audit Progress Findings Recommendations SummaryNote ↗
    2026-06-29AI Dashboard Scoping Meeting Note TemplateNote ↗
    2026-06-29AI Dashboard Scoping Meeting Report v1Note ↗
    2026-06-29AI Dashboard Scoping NACOSA Enterprise Gilead SummaryNote ↗
    2026-06-29Week Plan GeminiNote ↗
    2026-06-30Check in GeminiNote ↗

    Full catalogue incl. Notion & Google Drive originals: 09_Notion_and_Summaries/_FULL-INVENTORY.md. Repository under POL 986 AED · CONFIDENTIAL — CLIENT · curated 20 Jul 2026.

    Closing

    From findings to a
    lean, sovereign, funder-ready estate.

    Twenty-one systems audited. R335k+ a year identified. One cliff avoided. One cluster, drawn to the node, ready to build. Thank you — to Lilian, Neetin, Pierre and every stakeholder who opened their systems and their calendars.

    Ionity Global (Pty) LtdBuilding Tomorrow, Today
    Contactinfo@ionity.today · +27 646 999 877
    Webwww.ionity.co.za · ionity.world
    Signature — Johan Wilhelm van Antwerp
    Johan Wilhelm van Antwerp
    Founder · Technical Lead & Architect
    Ionity Global (Pty) Ltd · AEDI
    Other Business Cards

    Ionity Global (Pty) Ltd

    Architecture and delivery partner.
    info@ionity.today
    +27 646 999 877

    Project Delivery Desk

    Implementation handover and support routing.
    services@ionity.world
    www.ionity.world

    Founder Office

    Executive technical sign-off and governance.
    johan@ionity.today
    www.ionity.co.za

    “Anything is Possible with God.” · POL 986 AED · © 2026 Ionity Global (Pty) Ltd · TM
    Ionity — living brand card
    IONITY GLOBAL
    for
    VI
    Final Chapter

    DOME is the build direction for Phase 2.

    The audit establishes a DOME-network consolidation path: simplify the estate, preserve the systems that are working, retire avoidable sprawl, and move only through controlled approvals and evidence-backed acceptance.

    Consolidation coreDOME network target
    RetainAzure · S-Cube / BioSync
    RetireData Warehouse into DOME
    Exit conditionAWS after parallel-run acceptance
    One-page short version

    Final direction: build DOME through signed gates.

    The target is clear; the implementation remains disciplined. Retain Azure and S-Cube/BioSync, fold the Data Warehouse into the DOME direction, select the finance platform through the recorded evaluation, and exit AWS only after a verified parallel run.

    Recommendation R-Short

    • Use DOME as the Phase 2 consolidation target with no net-new systems added outside the approved model.
    • Retain Azure for identity, productivity, reporting and integration services.
    • Retain S-Cube / BioSync while the finance consolidation path is formally selected.
    • Retire the Data Warehouse into the DOME reporting direction after direct reporting links are validated.
    • Exit AWS only after parallel-run validation, custody handover, and documented client acceptance.

    Execution order (concise)

    Step 1: Stabilise access, ownership and evidence.
    Step 2: Design DOME integration and reporting boundaries.
    Step 3: Select the finance consolidation route and migrate by approved workstream.
    Step 4: Exit AWS only after a verified parallel run and acceptance.

    Target architecture (visual reference)

    Shout system architecture baseline visual
    DOME: target consolidation layer Keep: Azure Keep: S-Cube / BioSync Decide: finance platform Exit: AWS after acceptance

    Baseline architecture image included as provided. The decision overlay is intentionally specific only where the audit evidence is settled: DOME-centered consolidation, Azure and S-Cube/BioSync retained, the finance platform selected through its evaluation, and AWS removed only after parallel-run verification.

    Phase 2 · start with the evidence, not assumptions

    DOME can start now. The gates keep it honest.

    The audit supplies the operating direction and a finite starting backlog. Each stream has a clear proof point before it becomes production work: no rip-and-replace, no new sprawl, and no AWS exit by assertion.

    Gate 01 · control

    Stabilise the estate

    Close access and ownership gaps, establish individual accountability, and preserve the evidence needed for POPIA, supplier and handover decisions.

    Proof: approved access register, ownership record and remediation evidence.

    Gate 02 · design

    Stand up the DOME spine

    Define the Azure identity, integration and reporting boundaries; validate direct reporting links before retiring the Data Warehouse into the target model.

    Proof: signed target architecture and reporting acceptance.

    Gate 03 · decide

    Select the finance route

    Complete the recorded Dynamics-versus-Sage evaluation, retain S-Cube/BioSync, and sequence the selected consolidation route through a staged handover.

    Proof: client decision, integration plan and cut-over schedule.

    AWS is an acceptance gate, not a calendar date

    Migrate the approved workloads in parallel, verify data and operational outcomes, complete custody handover, then obtain written client acceptance before any decommission. This keeps the audit's central risk reduction intact while preserving clinical continuity.

    What the client signs

    DOME target architecture · finance selection · migration workstream scope · parallel-run acceptance criteria · accountable owners.

    Evidence basis: Phase 1 master summary and recorded decisions: Phase 2 DOME-network consolidation; AWS as the critical priority; Data Warehouse retirement into DOME; S-Cube/BioSync retention; finance consolidation evaluation; and no net-new sprawl.

    Standard Operating Procedure

    Every system gets up to 3 paths; IONITY is the recommended route.

    The audit applied the same decision pattern to each system: capture current state, list viable alternatives, score against risk / cost / sovereignty / capability, then recommend the path that lands the estate on a leaner, funder-ready footing.

    SMART 2.0 — Clinical hub

    • A. Keep cloud-hosted with current supplier.
    • B. Re-host to Azure / third-party VM.
    • C. REC: Build offline-capable modules on Ionity edge nodes, sync to DOME.

    CHOMI / AIMEE — WhatsApp GBV bot

    • A. Stay on Botpress cloud.
    • B. Rebuild as standalone app.
    • C. REC: Hybrid WhatsApp + lightweight PWA (Option C), 3–4 week timeline.

    Finance backbone

    • A. Extend Sage Evolution V9 (EOL risk).
    • B. Dynamics 365 Business Central (~R20k/yr, 60% NGO discount).
    • C. REC: Sage 300 People with S-Cube/BioSync API retention, NPO pricing.

    MojaMind — e-Learning

    • A. Continue with original vendor.
    • B. Replatform to a new LMS.
    • C. REC: Vendor takeover under evaluation; retain inside Azure R25k barrier.

    Data Warehouse + SSRS

    • A. Maintain legacy SQL Server stack.
    • B. Lift to Azure Synapse / Power BI.
    • C. REC: Retire into DOME-RAG reporting; replace SSRS with AI dashboard agent.

    AWS hosting

    • A. Renew reserved instance and absorb cliff.
    • B. Migrate to Microsoft Azure.
    • C. REC: Ionity Private Intranet / DOME cluster after parallel-run acceptance.

    Snipe-IT / asset register

    • A. Leave as-is on Azure.
    • B. Merge into a larger service-desk suite.
    • C. REC: Recover access, register into finance, then decommission.

    Cross-cutting rule

    • Optimise-and-consolidate before replace.
    • No net-new systems outside approved model.
    • IONITY implements the recommended path; alternatives remain documented for board reference.

    Sources: System_Assessment_Updated_Apr2026.xlsx, Full_Systems_Alternatives_Review, finance-meeting notes (25–26 Jun), and recorded platform decisions (19 Jun, 22 Jun, 24 Jun).

    Thank you

    Audit complete.
    Conversation continues.

    Scan the code to join the private Shout-It-Now × Ionity forum. Ask follow-up questions, track Phase 2 decisions, and access curated updates as the DOME build progresses.

    ionity.art

    Forum hosted at ionity.art — not www.ionity.art. Repository remains private; only this presentation is published on ionity.xyz.