Compliance ventures, built and run by 02X
02X builds focused, app-based compliance businesses for South Africa's regulated industries, then operates them as standalone brands with human supervision at their core.
Each venture takes one heavy, admin-intensive area of compliance and turns it into a managed service: software handles the tracking, reminders and document generation, while qualified people own the review and sign-off. We start with the area under the most pressure and expand app by app, without asking clients to rebuild their records or workflows.
GRC Shop, our flagship venture
GRC Shop is the first live 02X venture. It provides outsourced, app-based managed compliance for South African companies, starting with Occupational Health and Safety and expanding across POPIA, Labour, FICA and AML, CIPC and SARS. It replaces expensive specialist retainers and fragile spreadsheets with one managed service that businesses activate app by app, built specifically around South African legislation.
The Occupational Health and Safety app is live and fully operational today. It manages statutory appointments, registers, risk assessments, evidence and renewals, with human oversight on every material decision. Further compliance apps follow a published roadmap.
What GRC Shop actually operates today
The occupational health and safety service is live and carrying real client obligations. It holds the statutory appointment set for each client site, computes what each site requires against the correct counting basis under the Occupational Health and Safety Act 85 of 1993 and its regulations, links every appointment letter to the certificate that supports it, and drops the appointment when the certificate lapses rather than leaving a paper record that looks compliant and is not.
Around that sit the registers a Department of Employment and Labour inspector asks for: the site register, the officer and appointment registers, certificates, contractors, incidents, hazard identification and risk assessment records, fire equipment, and the committee record. Clients see their own position through a portal rather than through a monthly report, and the same records drive the emergency accountability side of the service, including live site presence and roll-call during an evacuation.
The service is deliberately not self service software. Software handles the tracking, the reminders and the paperwork. Qualified people own the review and the sign-off, and the client keeps ownership of the remediation decisions. That division is the product.
How a venture gets built here
Every venture starts from sourced statutory rules rather than from a product idea. The relevant Act and its gazetted regulations are read, the operative provisions are recorded with their section numbers, amendments are tracked against the Government Gazette, and only then is anything designed. Where a widely repeated industry figure does not match the gazetted wording, the gazetted wording wins and the difference is documented.
That discipline is not decoration. Two of the ratios most commonly quoted in South African occupational health and safety do not match what the Act says, and a compliance product built on the market version of a rule will confidently under or over state what a client owes. The statutory rules our platform encodes are held as data, scoped to a jurisdiction, and reviewed when the law moves.
The venture roadmap, and why it is sequenced
POPIA is next and is in development. Labour, FICA and anti money laundering, CIPC and SARS follow, in that broad order. They are sequenced rather than built in parallel because each one needs its own sourced rule set, and because a compliance service that launches four half accurate modules is worth less than one that launches a single accurate one.
Each roadmap domain publishes a free, sourced readiness checklist on the GRC Shop site ahead of its app, so the underlying obligation is useful to a business whether or not it ever becomes a client.
Future ventures
02X is a venture builder, so GRC Shop is the first of several planned businesses rather than the whole company. We are actively developing further ventures in regulated, compliance-heavy sectors where the same model applies: a clear statutory obligation, a heavy manual workload, and a real need for accountable human oversight alongside good software. New ventures will be announced here as they launch.