Security and trust

Security built into every decision.

You are being asked to connect a system to your ERP — read-only unless you switch governed write-back on, and only for the workflows you approve. The controls below follow the path of the data—from connection and computation through recommendation, approval and audit—so your security team can evaluate the system by layer.

Report a vulnerability Data protection enquiry

How it works

The path of one request

Four checks between a person and your data.

Follow one request from sign-in to the audit row. Every number on the drawing is the one the code uses.

Passwordscryptper-user salt · members lock after 3 failures

Authenticator6 digits · 30 severy password sign-in

ScopeFrom the sessionnever from the request

Other tenantsNo pathisolation suite runs in CI

Approval9 of 13 roleshold approval:decide · 72 h expiry

The AIDrafts onlyrecommend · request · notify

Audit rowActor · before · after+ reason · kept 7 years

Recheck24–72 h lateragainst the latest synced data

How it works

01 Sign in

A password is not enough. Email is never the second factor.

Every password sign-in needs a code from an authenticator app. Email only resets a password. A session ends after 15 idle minutes and never lasts longer than 8 hours.

Passwordscrypt, per-user salt; a member account locks after 3 failures
Authenticator6 digits, 30 s, every password sign-in; 10 recovery codes
Session15 minutes idle, 8 hours at most

02 Scope

Your organisation comes from the session, not the request.

Business queries are scoped to the organisation the session belongs to. A request cannot name its way into another tenant, and an isolation suite in CI checks that one organisation’s rows never come back through another’s scope.

Scopethe organisation in the session, never the request
Other tenantsnot reachable; checked by the isolation suite in CI

03 Approve

The AI drafts. A person with authority decides.

The AI’s only write tools create a recommendation, an approval request or a notification. A governed action runs once a role with approval rights approves it, unless a client switches on bounded autonomy. An unanswered request expires after 72 hours.

The AIrecommend, request approval, notify; nothing else
Approval9 of 13 roles hold approval:decide
Expiry72 hours unanswered

04 Record

Every change leaves a row.

Actor, before, after and reason are written for state changes and kept for seven years. An executed action is rechecked 24 to 72 hours later against the latest synced data.

Audit rowactor, before, after, reason
Retention7 years, then a daily purge
Recheck24 to 72 hours after the action

Operating today

Controls that run, with the evidence they produce.

Control	How it works
Tenant isolation	Business queries are scoped to the organisation in the session, never one named in the request. A dedicated isolation suite runs in CI.
Role-based access	17 permissions across 13 roles, enforced server-side. Roles are additive from viewer upward, and the automated agents hold a narrower set than the people who trigger them.
Two-factor authentication	Time-based one-time codes from an authenticator app, with ten single-use recovery codes. Required for every password sign-in, administrators and members alike. The holder cannot switch it off; email is never the second factor.
Password handling	12-character minimum, scrypt with a per-user salt, rate limiting on failures by account and by address, 8-hour sessions.
Encryption of credentials	AES-256-GCM for connector credentials and second-factor secrets. A credential is never returned to a browser and is redacted in every audit row.
Authentication logging	Every sign-in, sign-out, failure and rate-limit refusal, with account, address, user agent and reason. The reason is recorded precisely and returned to the caller as nothing — which is what stops the login form becoming an account-enumeration oracle.
Audit trail	Actor, before, after and reason on state changes, kept for seven years. Platform administrator actions are audited too.
Log retention	Enforced by a daily purge: security events one year, audit rows seven. A misconfigured period falls back to the default rather than becoming "delete everything".
Dependency scanning	Every push, every pull request, and weekly. High and critical findings block the build. Currently zero at every level.
Outbound request guard	Every connector URL — and every page cursor a remote hands back — is checked before it is fetched. Loopback and cloud metadata addresses are refused.

Privacy and AI

Your data is not training data.

The AI in SIAARU explains, drafts and summarises. It does not compute a number you will act on — that is the KPI engine, and it is architecturally forbidden from reaching a model at all.

What that means for you in practice: the numbers on your dashboard never passed through a language model, so they cannot have been invented by one. When the copilot answers a question, it cites the records its answer came from.

Under the Digital Personal Data Protection Act, 2023, we publish a contact for data-principal requests and answer them. Write to privacy@siaaru.com. What we collect and why is set out in the privacy notice; what we are contractually bound to, in the terms.

Commitments

No training on customer data. Not ours, not our model provider's.
Data stays in one region. Today that is Singapore (AWS ap-southeast-1), for every customer. Indian hosting is planned, not live.
Two exports exist today. The rows behind any KPI, as CSV or Excel, in the column layout of SAP, SAP Business One, Oracle or Dynamics; and the Master Data cross-reference, as CSV. There is no single archive of every table, and no export of documents or the audit trail. After a subscription ends, the Terms give you 30 days to ask us for your data. That is a request to us, not a button.
Deletion on request, within the period stated in the contract.
Subprocessors are listed, and you are told before one changes.

Where we actually stand

We are not SOC 2 certified.

Saying otherwise is the fastest way to lose an enterprise deal and the trust behind it. Here is the position, stated the way we would want it stated to us.

The technical controls an audit examines are in place — the table above is the list, and every row names something that runs today.
The policy set is written — ten governance policies covering information security, access control, incident response, change management, risk, data retention, business continuity, vendor management, acceptable use and asset management.
The certificate follows the observation window. A Type II report attests that controls operated effectively over three to twelve months. That clock starts when the policies are adopted and followed rather than when they are written, so it cannot be compressed — the controls the report will examine are the ones running today.
A penetration test is booked with the cloud migration. Until it is done we will not describe this as pen-tested, and we will send you the report when it exists.
Logging goes to standard output today. Centralised logging and alerting land with the same migration; nothing pages a human before then.
Engineering is one person. Code review has somewhere to happen and no second reviewer to happen with. You should know that before you buy rather than discover it after — it is the same reason the company page says how early this is, and the module list marks what is still opening.

We will complete your security questionnaire today and give you a target date for a Type II report. Ask us for either.