πŸ” Security First

Security at Iltizam

Enterprise-grade protection built into every layer of the platform β€” updated April 2026.

AES-256
Encryption at Rest
TOTP 2FA
Replay-Protected
100%
Auth & Write Events Logged
TLS 1.2+
In Transit + HSTS
PDPL
Saudi & UAE Compliant
πŸ”

AES-256 Encryption at Rest

Every sensitive field is individually encrypted using AES-256-CBC via Laravel Crypt: employee iqama numbers (Saudi national IDs), ZATCA credentials, webhook signing secrets, government portal credentials, and compliance notes. None of these values are stored in plaintext. Your encryption key lives in the environment and is never exposed in code or database.

🌐

TLS Encryption in Transit

All data transmitted between your browser and Iltizam servers is protected by TLS 1.2 or higher. We enforce HTTPS-only access and set HTTP Strict Transport Security (HSTS) headers. Unencrypted HTTP connections are rejected.

πŸ“±

Two-Factor Authentication with Replay Prevention

All accounts support TOTP-based 2FA compatible with Google Authenticator, Authy, and Microsoft Authenticator. Iltizam uses cryptographic timestamp tracking to prevent TOTP replay attacks β€” each 30-second code can only be used once. 2FA is available for all roles and is strongly recommended.

πŸ›‘οΈ

Strict Role-Based Access Control

Iltizam enforces a three-tier role system at the server level: Super Admin (platform), Company Admin (write access), and Employee (read-only). Write operations β€” create, update, delete β€” are blocked at the middleware layer for the Employee role, not just hidden in the UI. Company data is fully isolated; cross-company data access is architecturally impossible.

πŸ“

Full Audit Logging β€” Including Auth Events

Every create, update, and delete is logged with the user identity, action type, affected record, IP address, and before/after values. Authentication events β€” successful logins, failed login attempts, logouts, 2FA enabled/disabled/verified β€” are also logged. Audit logs are searchable, filterable, and exportable by platform admins.

πŸ”

HMAC-Signed Webhooks

Every outbound webhook POST is signed with HMAC-SHA256 using a unique per-subscription secret encrypted at rest. Recipients can verify the X-Iltizam-Signature header to confirm payload authenticity and prevent spoofing attacks.

☁️

Secure File Storage

Files are stored on AWS S3 in a private bucket with no public-read ACL. Downloads are served via temporary pre-signed URLs with a 30-minute expiry. File paths use UUID-based names, preventing enumeration attacks.

πŸ”‘

Password, Login & Session Security

Passwords require a minimum of 10 characters with mixed case and numbers. Passwords are hashed with bcrypt (cost factor 12). Login is rate-limited to 5 attempts per minute per IP. Inactive accounts are blocked at the authentication layer. Sessions are encrypted at rest and use SameSite=Strict cookie policy. Email verification is required before portal access is granted.

🧱

Security Response Headers

Every response includes X-Content-Type-Options, X-Frame-Options (DENY), X-XSS-Protection, Referrer-Policy (strict-origin-when-cross-origin), and Permissions-Policy. HSTS is enforced on HTTPS deployments. Cross-Origin Resource Sharing (CORS) is restricted to the application origin only.

πŸ‡ΈπŸ‡¦

PDPL Compliance & AI Data Governance

The AI Compliance Advisor requires explicit consent before sending any data to OpenAI, in compliance with the Saudi Personal Data Protection Law (PDPL) cross-border transfer requirements. Only anonymized aggregate data is transmitted β€” no names, IDs, or iqama numbers. Employee iqama numbers are treated as national identifiers under PDPL and are encrypted at field level. UAE companies benefit from alignment with Federal Decree-Law No. 45 of 2021.

OWASP Top 10 Coverage

Iltizam is designed with OWASP Top 10 mitigations built into every layer β€” covering broken access control, cryptographic failures, injection, insecure design, security misconfiguration, logging & monitoring, and more. Updated April 2026.

A01
A02
A03
A04
A05
A06
A07
A08
A09
A10
A01 Broken Access Control β€” server-side RBAC middleware, write routes restricted by role A02 Cryptographic Failures β€” AES-256 encryption for all sensitive fields at rest A03 Injection β€” parameterised queries, CSRF tokens, input validation throughout A04 Insecure Design β€” gov credentials in encrypted DB column, AI consent required A05 Security Misconfiguration β€” security headers, SameSite sessions, CORS restricted A06 Vulnerable Components β€” regular composer updates; marked for periodic review A07 Identification & Auth β€” TOTP replay prevention, email verification, rate limiting A08 Software & Data Integrity β€” HMAC-signed webhooks, guarded mass-assignment fields A09 Logging & Monitoring β€” auth events, all writes logged with IP and before/after values A10 SSRF β€” outbound requests via Laravel HTTP client with explicit trusted endpoints
πŸ’¬

Security Questions?

Our team is available to answer security questions from enterprise customers, auditors, and compliance officers.

Contact