Trust and security
What we can state about security today.
This page lists only what is true of the product now. Items in square brackets are still being finalised and will be published here; we will not describe them until they are.
Security controls
Each control is marked as it stands today: Live, Roadmap or To be confirmed.
- Live
Role-based access (RBAC)
Five roles decide who sees and changes what; API keys are scoped the same way.
- Live
Tenant isolation
Every record carries its organisation, and every query is filtered by it.
- Live
Audit trail
Who changed what, and when, exported to CSV or JSON.
- Live
Export and portability
Ten registers export to CSV and JSON at any time, audit trail included.
- Live
Secrets: AI provider keys
Encrypted with AES-256-GCM; personal data is removed before any AI call.
- Live
UAE data residency
Deployable in a UAE cloud region, so records can stay in the country.
- Live
Signed webhooks
HMAC-SHA256 signature with a timestamp on every event.
- To be confirmed
Encryption in transit and at rest
TLS in transit; at-rest encryption by the hosting provider. Details: [ENCRYPTION DETAILS].
- Live
Vulnerability management
Code, dependency, secret, container and web scanning on every change and weekly, with automatic update pull requests. Penetration test: [PENETRATION TEST DATE].
- Live
Single sign-on: OIDC and SAML
Sign in with Entra ID, Okta, AD FS or any OIDC or SAML 2.0 provider, with group-to-role mapping.
- To be confirmed
UAE PASS sign-in
Built and switched off until each organisation completes UAE PASS onboarding with TDRA.
- Live
Multi-factor authentication
Authenticator-app codes, passkeys and recovery codes, enforceable per organisation, role and duty.
- Roadmap
SCIM provisioning
Users and roles kept in step with your directory.
Standards
Controls are aligned to ISO/IEC 27001 and SOC 2. Certification is not yet held, and we do not claim it.
Security white paper
The same facts in a PDF for your security review (English).
Audit and security questions: [AUDIT CONTACT EMAIL]
Being finalised To be confirmed
We will publish these here. Until then, ask us and we will answer in writing.
| Item | Status |
|---|---|
| Certifications | Not yet held · aligned to ISO/IEC 27001 and SOC 2 |
| Hosting provider and region | [HOSTING PROVIDER] |
| Encryption at rest and in transit | [ENCRYPTION AT REST AND IN TRANSIT DETAILS] |
| Latest independent penetration test | [PEN-TEST DATE] · [PEN-TEST FIRM] |
| Sub-processors | [SUB-PROCESSOR LIST] |
| Data processing agreement | [DPA TEMPLATE] |
| Data retention and deletion | [DATA RETENTION POLICY] |
This website
- The walkthrough, the demos, the format checks and the maturity self-assessment run in your browser and send nothing to us.
- This site's pages include no analytics or advertising scripts. Its fonts come from Google Fonts.
- Until launch, the demo request form does not send your details anywhere.
Doing due diligence on us?
We will complete your security questionnaire. Write to us at
[SECURITY CONTACT]