Compliance & Trust

ISO 27001 Aligned

Our security practices are built around the control domains of ISO/IEC 27001, the international standard for information security management. We describe this as "aligned" rather than "certified" — we have not undergone formal third-party ISO 27001 certification.

Technical safeguards

• AES-256 encryption for data at rest • TLS 1.3 for data in transit • API key encryption using AES-256-CBC • bcrypt password hashing (12 rounds) • Automated anomaly detection and alerting

Organisational controls

• Multi-factor authentication for all staff accounts • Role-based access controls — staff access only the minimum data required to do their job • Regular penetration testing and security audits • A documented incident response plan, including UAE PDPL-aligned breach notification timelines

Why "aligned" and not "certified"

ISO 27001 certification requires a formal, audited information security management system assessed by an accredited external body. We hold ourselves to the standard's control objectives today, and are transparent that we have not yet completed that formal certification process.

ISO 27001 Aligned

Technical safeguards

• AES-256 encryption for data at rest • TLS 1.3 for data in transit • API key encryption using AES-256-CBC • bcrypt password hashing (12 rounds) • Automated anomaly detection and alerting