Security and trust
What is in place, and what is not.
You are being asked to connect a system to your ERP. The honest version of this page is worth more to you than a page of badges — so below are the controls that operate today, and, in the same detail, the ones that do not.
Operating today
Controls that run, with the evidence they produce.
| Control | How it works |
|---|---|
| Tenant isolation | All business data is reached through one scoped accessor. The organisation comes from the session, never from the request. A dedicated isolation suite runs in CI. |
| Role-based access | 17 permissions across 10 roles, enforced server-side. Roles are additive from viewer upward, and the automated agents hold a narrower set than the people who trigger them. |
| Two-factor authentication | Time-based one-time codes with single-use recovery codes. Mandatory for platform administrators and not switchable off by the holder. |
| Password handling | 12-character minimum, scrypt with a per-user salt, rate limiting on failures by account and by address, 8-hour sessions. |
| Encryption of credentials | AES-256-GCM for connector credentials and second-factor secrets. A credential is never returned to a browser and is redacted in every audit row. |
| Authentication logging | Every sign-in, sign-out, failure and rate-limit refusal, with account, address, user agent and reason. The reason is recorded precisely and returned to the caller as nothing — which is what stops the login form becoming an account-enumeration oracle. |
| Audit trail | Actor, before, after and reason on every state change. Administrator actions write a row the tenant can see. |
| Log retention | Enforced by a daily purge: security events one year, audit rows seven. A misconfigured period falls back to the default rather than becoming "delete everything". |
| Dependency scanning | Every push, every pull request, and weekly. High and critical findings block the build. Currently zero at every level. |
| Outbound request guard | Every connector URL — and every page cursor a remote hands back — is checked before it is fetched. Loopback and cloud metadata addresses are refused. |
Privacy and AI
Your data is not training data.
The AI in SIAARU explains, drafts and summarises. It does not compute a number you will act on — that is the KPI engine, and it is architecturally forbidden from reaching a model at all.
What that means for you in practice: the figures on your dashboard never passed through a language model, so they cannot have been invented by one. When the copilot answers a question, it cites the records its answer came from.
Under the Digital Personal Data Protection Act, 2023, we publish a contact for data-principal requests and answer them. Write to privacy@siaaru.com.
Commitments
- No training on customer data. Not ours, not our model provider's.
- Data stays in your region. Indian customers are deployed in India.
- Export any time, in full. CSV, without asking us.
- Deletion on request, within the period stated in the contract.
- Subprocessors are listed, and you are told before one changes.
Where we actually stand
We are not SOC 2 certified.
Saying otherwise is the fastest way to lose an enterprise deal and the trust behind it. Here is the position, stated the way we would want it stated to us.
- The technical controls an audit examines are in place — the table above is the list, and every row names something that runs today.
- The policy set is written — ten governance policies covering information security, access control, incident response, change management, risk, data retention, business continuity, vendor management, acceptable use and asset management.
- What we do not have is the certification, or the observation window behind it. A Type II report attests that controls operated effectively over three to twelve months. That clock starts when the policies are adopted and followed — not when they were written — and it cannot be compressed.
- No penetration test yet. Scheduled with the cloud migration.
- Centralised logging and alerting are not in place. Logs go to standard output; nothing pages a human today.
- There is one engineer. Code review has somewhere to happen and no second reviewer to happen with. We would rather you knew that than discovered it.
We will complete your security questionnaire today and give you a target date for a Type II report. Ask us for either.