The security brief.
One page for your legal and technical teams.
An executive summary of API360’s security and compliance controls — written to be read in five minutes and shared with governance and procurement as it is.
Controls summary
Encryption
Full encryption in transit via TLS 1.3 and at rest via AES-256. Keys are managed in HSMs, with scheduled rotation and complete separation between customer environments.
Sovereignty
Hosting, processing, storage, backups, and supporting services are inside Saudi Arabia. This describes data residency and does not constitute a security certification.
Compliance
Aligned with the Personal Data Protection Law (PDPL) and the Essential Cybersecurity Controls (NCA ECC). ISO 27001 certification is in progress.
Access control
Role- and attribute-based permissions, single sign-on through the identity service, and audit logs of account actions.
Business continuity
Service levels are agreed by contract; backups and recovery arrangements depend on the applicable plan and service.
Responsible disclosure
A reporting channel for security researchers at info@api360.sa. Rewards and response or remediation deadlines are not currently published.