Security

1. Encryption

In transit: all traffic is served over HTTPS/TLS; data between your browser and the servers is encrypted end to end.

At rest: sensitive personal data (PII) is encrypted at rest at the field level using strong, industry-standard encryption (AES via Fernet), with support for key rotation.

2. Data residency & isolation

SAIBA Corporate is multi-tenant with strict tenant isolation — every record is scoped to its tenant and tenants can never read each other’s data. Operational data can be stored in the region you require, and the platform can be deployed entirely on your own infrastructure (on-premise) for full data residency and control.

3. Access controls

Authentication uses signed JSON Web Tokens (JWT); passwords are hashed and never stored in plain text. Role-based access control scopes what each user can view, add, edit or approve — by module, business unit and policy category — and sign-off workflows and a full audit trail cover the actions that matter. Administrative access is restricted and can be limited to allow-listed IP addresses.

4. Application security

We follow secure development practices aligned with the OWASP Top 10, including protection against injection, broken access control and cross-site attacks. Input is validated server-side and tenant scope is enforced on every request.

5. Backups & availability

For cloud deployments, data is backed up regularly to enable recovery in the event of an incident, and we monitor our systems for availability and integrity. For on-premise deployments, backup and availability are managed within your own environment.

6. Reporting a vulnerability

We welcome responsible disclosure. If you believe you’ve found a security vulnerability, please contact us so we can investigate and respond promptly, and refrain from public disclosure until it is resolved. Security & privacy: compliance@simsononline.com.