Security and trust
What is in place, and what is not.
You are being asked to connect a system to your ERP — read-only unless you switch write-back on, and only the tables we name. The honest version of this page is worth more to you than a page of badges, so below are the controls that operate today, and, in the same detail, the ones that do not.
Operating today
Controls that run, with the evidence they produce.
| Control | How it works |
|---|---|
| Tenant isolation | All business data is reached through one scoped accessor. The organisation comes from the session, never from the request. A dedicated isolation suite runs in CI. |
| Role-based access | 17 permissions across 10 roles, enforced server-side. Roles are additive from viewer upward, and the automated agents hold a narrower set than the people who trigger them. |
| Two-factor authentication | Time-based one-time codes with single-use recovery codes. Mandatory for platform administrators and not switchable off by the holder. |
| Password handling | 12-character minimum, scrypt with a per-user salt, rate limiting on failures by account and by address, 8-hour sessions. |
| Encryption of credentials | AES-256-GCM for connector credentials and second-factor secrets. A credential is never returned to a browser and is redacted in every audit row. |
| Authentication logging | Every sign-in, sign-out, failure and rate-limit refusal, with account, address, user agent and reason. The reason is recorded precisely and returned to the caller as nothing — which is what stops the login form becoming an account-enumeration oracle. |
| Audit trail | Actor, before, after and reason on every state change. Administrator actions write a row the tenant can see. |
| Log retention | Enforced by a daily purge: security events one year, audit rows seven. A misconfigured period falls back to the default rather than becoming "delete everything". |
| Dependency scanning | Every push, every pull request, and weekly. High and critical findings block the build. Currently zero at every level. |
| Outbound request guard | Every connector URL — and every page cursor a remote hands back — is checked before it is fetched. Loopback and cloud metadata addresses are refused. |
Privacy and AI
Your data is not training data.
The AI in SIAARU explains, drafts and summarises. It does not compute a number you will act on — that is the KPI engine, and it is architecturally forbidden from reaching a model at all.
What that means for you in practice: the figures on your dashboard never passed through a language model, so they cannot have been invented by one. When the copilot answers a question, it cites the records its answer came from.
Under the Digital Personal Data Protection Act, 2023, we publish a contact for data-principal requests and answer them. Write to privacy@siaaru.com. What we collect and why is set out in the privacy notice; what we are contractually bound to, in the terms.
Commitments
- No training on customer data. Not ours, not our model provider's.
- Data stays in your region. Indian customers are deployed in India.
- Export any time, in full. CSV, without asking us.
- Deletion on request, within the period stated in the contract.
- Subprocessors are listed, and you are told before one changes.
Where we actually stand
We are not SOC 2 certified.
Saying otherwise is the fastest way to lose an enterprise deal and the trust behind it. Here is the position, stated the way we would want it stated to us.
- The technical controls an audit examines are in place — the table above is the list, and every row names something that runs today.
- The policy set is written — ten governance policies covering information security, access control, incident response, change management, risk, data retention, business continuity, vendor management, acceptable use and asset management.
- The certificate follows the observation window. A Type II report attests that controls operated effectively over three to twelve months. That clock starts when the policies are adopted and followed rather than when they are written, so it cannot be compressed — the controls the report will examine are the ones running today.
- A penetration test is booked with the cloud migration. Until it is done we will not describe this as pen-tested, and we will send you the report when it exists.
- Logging goes to standard output today. Centralised logging and alerting land with the same migration; nothing pages a human before then.
- Engineering is one person. Code review has somewhere to happen and no second reviewer to happen with. You should know that before you buy rather than discover it after — it is the same reason the company page says how early this is, and the module list marks what is still opening.
We will complete your security questionnaire today and give you a target date for a Type II report. Ask us for either.