Certifications in progress, stated plainly.
We don’t claim what we don’t hold — this is the status of each standard as it stands today, kept up to date.
PDPL Compliance
The Saudi Personal Data Protection Law. A compliance specialist reviewed our technical and operational controls — that is a controls review, not sign-off on the drafting of our legal documents.
SDAIA Policies
SDAIA policies. Built into the design from the start.
NCA Controls
The Essential Cybersecurity Controls from the National Cybersecurity Authority.
ISO 27001
The international information-security management standard. Certification is in progress with an accredited auditor.
SOC 2 Type II
Operational controls audited over a continuous observation window — observation is under way.
Defence at every layer.
No single security measure covers everything. We layer several, each closing a different class of risk.
End-to-end encryption
Encrypted connections over TLS, and encryption of data at rest.
Multiple authentication methods
OAuth 2.0 · API keys · JWT · mTLS for critical connections. Two-factor is mandatory on administrative accounts.
Encrypted audit logs
Every administrative action is recorded, timestamped, and encrypted. Direct export to SIEM for enterprise customers.
Hosted inside the Kingdom
The production platform runs in a cloud region inside Saudi Arabia. This hosting statement is separate from any security certification.
Fine-grained governance
RBAC · ABAC · just-in-time permissions · separation of duties across critical roles. Policies you can customise.
DDoS protection
Advanced mitigation at layers 3 and 7, with smart rate limiting that distinguishes a legitimate user from an attack.
Found a vulnerability? Tell us first.
We value security researchers. Please report suspected vulnerabilities to info@api360.sa; rewards and response or remediation deadlines are not currently published.
Report suspected vulnerabilities to info@api360.sa. Rewards and response or remediation deadlines are not currently published.