Security

1. Encryption

• In transit: All traffic is served over HTTPS/TLS. Data moving between your browser and our servers is encrypted end-to-end.
• At rest: Sensitive personal data (PII) is encrypted at rest at the field level using strong, industry-standard encryption (AES via Fernet), with support for key rotation.

2. Data Residency & Isolation

SaibaCRM is multi-tenant with strict tenant isolation — every record is scoped to its tenant and tenants can never read each other's data. Operational personal data is stored in the data region for your country (for example, UAE customers are served from a UAE data store) to support data residency requirements.

3. Access Controls

• Authentication uses signed JSON Web Tokens (JWT); passwords are hashed and never stored in plain text.
• Role-based access control — owners/admins manage the account, while invited users can be limited to view-only access with no authority to modify or delete.
• Administrative access is restricted and can be limited to allow-listed IP addresses.

4. Application Security

We follow secure development practices aligned with the OWASP Top 10, including protection against injection, broken access control and cross-site attacks. Input is validated server-side and tenant scope is enforced on every request.

5. Payments

Payments are processed by our PCI-DSS compliant payment partner. We do not store card numbers or sensitive payment credentials on our servers.

6. Backups & Availability

Data is backed up regularly to enable recovery in the event of an incident. We monitor our systems for availability and integrity.

7. Reporting a Vulnerability

We welcome responsible disclosure. If you believe you've found a security vulnerability, please contact us so we can investigate and respond promptly. Please do not publicly disclose the issue until it has been resolved.