How we protect customer data, who has access to what, where data lives, and how to report security issues. We list only the controls we actually run in production.
Every claim below maps to a configuration we operate in production — not a roadmap item.
Our production servers are operated for us by a third-party infrastructure provider and are currently located outside Saudi Arabia. SanadWA Company is a Saudi company and is subject to the Saudi Personal Data Protection Law (PDPL) wherever our infrastructure sits. A data residency review covering production hosting, backups, and sub-processor access is underway, and we are not publishing a residency commitment until it concludes. Last verified: 2026-09-13.
All public traffic is terminated at our Caddy reverse proxy with TLS 1.2+ and modern cipher suites. HTTP requests are redirected to HTTPS.
User passwords are hashed with bcrypt. We never store, log, or transmit plaintext passwords. Password reset is handled via a one-time link.
Every workspace has three roles — owner, admin, and operator — with progressively narrower permissions. The API enforces role checks on every protected endpoint.
Operator actions and system events emit structured JSON logs to disk with stable schemas. Sensitive fields (tokens, message bodies) are redacted at the logger.
Every API request is scoped to the signed-in workspace. One workspace cannot read or write another workspace’s data.
Where we stand on data-protection regimes today. We err on the side of honesty — uncertified means uncertified.
Compliance work is underway. SanadWA Company is a Saudi company subject to the PDPL, and we have structured data flows to align with PDPL controller and processor responsibilities. Our production hosting is currently outside Saudi Arabia, and that cross-border transfer is part of the data residency review now in progress. Last verified: 2026-09-13. We have not yet undergone formal PDPL certification.
We honor GDPR data subject rights — access, deletion, and portability. Requests can be sent to the security inbox below.
If you believe you have found a vulnerability or a security incident affecting SanadWA, email admin@sanadais.com.
You can request deletion of your account and associated data at any time. Follow the steps on our data deletion page.