TRUST & SECURITY
Security should not be hidden in settings.
This page summarizes Saneed’s current controls and production architecture principles. We do not claim certifications or compliance levels that have not been formally verified.
Protection controls
Identity & sessions
Authentication is server-side. Passwords are not stored in plaintext, while verification, reset and session tokens are designed to be stored hashed with expiry.
Authorization
Customer access is based on organization membership and role, while Saneed staff use a separate permission model. Admin protection does not rely on hidden navigation alone.
Transport security
The production architecture requires TLS for public traffic and keeps sensitive credentials on the server side.
Payments
Saneed does not store full card data when an approved payment provider is used. Payment secrets and webhook validation are handled server-side.
Audit trail
Privileged actions are designed to be recorded in audit logs for review and accountability.
Saudi data architecture
Saneed’s production architecture is designed to keep customer databases, authentication, support, billing and sensitive backend processing in Saudi Arabia, separating public frontends from sensitive data services.
What we do not claim
- We do not claim SOC 2 or ISO 27001 unless Saneed is formally certified.
- We do not publish a specific at-rest encryption algorithm before verifying it in the live production environment.
- We distinguish implemented controls from architectural targets or required operational practices.
To report a security concern or request additional information, contact Saneed through the official contact form.