Your data is not our product
Intibaq is built on the principle that trust comes from design, not claims. Here is everything we do to protect your data — what we do, and what we cannot access.
Full tenant isolation
Every query is bound to the user's organization and covered by automated tests. the platform is isolated so that one organization's data does not appear in another's.
Hardened passwords & sessions
scrypt hashing with random salts and constant-time comparison; hashed sessions with SameSite=Strict that expire after seven days.
Layered two-factor verification
One-time codes are mandatory for the owner, compliance lead and the whole platform team, with one-time recovery codes stored hashed.
Encrypted, scanned files
Every file is encrypted with AES-256-GCM key rings, fingerprinted before encryption, virus-scanned before storage — and previous versions are kept as new versions and are not deleted individually.
Sealed audit trail
Every change and view is recorded in a hash chain, so any edit or deletion breaks the chain and is immediately exposed — and the log exports for your auditor.
Our team enters only with your consent
The Intibaq team sees your data only in a support mode with a written reason, a fixed duration and a second teammate's approval, and the org owner can require prior org approval for every entry — all in the audit trail.
A clear approach to personal data
Planned: names are removed in-Kingdom before any processing
Our adopted approach: the org structure is extracted in-Kingdom and employee names are deleted immediately, so only department and division names remain. Assistant questions are automatically scrubbed of emails, phone numbers and ID-like digits before processing with the AI provider.
In-Kingdom hosting for sensitive entities
For government entities and critical-infrastructure operators, full in-Kingdom hosting is our planned architecture, aligned with localization requirements.
What we don't claim
Frameworks inside the platform are mapped to their requirements, but they are not certifications. We do not currently hold an independent ISO 27001 or SOC 2, and we won't say otherwise until we do — we'd rather earn your trust through design and clarity.
A specific security question?
We're happy to show you the details — message us and we'll reply within one business day.
Contact us