Solutions
Security
The security controls in place on the Sanad platform: hosting in Riyadh, a separate database per company, two-factor authentication, TLS 1.3 and encrypted daily backups with restore tests.
Security
How we protect our customers' data on Sanad, our resource-planning platform. Every control below is in place on the platform today, and we build government projects to the same standard or to whatever each tender requires.
Hosting and data separation
- The platform's servers and databases run in a cloud data center inside Saudi Arabia, in Riyadh.
- Each company has its own database, so one organization's data never mixes with another's.
- Some AI features rely on an external provider. We agree with each agency whether they are used in its project.
Sign-in and permissions
- Two-factor authentication is mandatory, rolled out on a schedule for each role.
- Sign-in locks temporarily after five failed attempts in a row.
- Fine-grained permissions for every user and every screen, set by the organization's administrator.
Encryption and connection security
- All traffic to the platform is encrypted with TLS 1.3, and browsers are required to use HTTPS every time (HSTS).
- A content security policy and security headers stop our pages from being embedded in other sites.
- No management port is open to the internet. Servers are managed through an encrypted, key-based tunnel, and password sign-in to the servers is disabled.
Backup and recovery
- An encrypted daily backup of each company's data.
- A daily off-server copy at a second location, checked against its fingerprint after transfer.
- Automated database backups and a full disk image with our cloud provider.
- Regular restore tests on company backups, because a backup that has never been restored can't be relied on.
Monitoring and response
- An hourly check on backup age, with an alert if any backup falls behind.
- An automatic alert whenever company files are deleted on the server.
- A published policy for security researchers to report vulnerabilities: Vulnerability disclosure.
Frameworks we build to
We design our systems to the National Cybersecurity Authority's Essential Cybersecurity Controls and the Personal Data Protection Law. We cite them as design references, not as certificates issued to us. Details are on Qualifications and compliance.
What we don't offer
This page describes how we secure our own systems and products. We don't sell cybersecurity services to others, such as penetration testing or managed security operations. Those services require a license from the National Cybersecurity Authority, and when a project needs them we work with licensed providers.