Trust
How we protect tenant data.
NextEAM serves asset-intensive operators across the Kingdom of Saudi Arabia. Security, privacy, and continuity are designed into the platform — not bolted on. This page is the canonical source for the controls a procurement, security, or compliance reviewer will ask about.
Architecture
Multi-tenant isolation by default.
NextEAM is a single codebase running across many customer tenants. Every record carries a tenantIdcolumn. Three independent layers enforce that records from one tenant never leak into another's response.
- JWT-scoped session
- Every authenticated request carries a tenantId from the user’s session token. The backend rejects tokens missing or mismatched against the request URL.
- Prisma middleware tenant scoping
- A database-layer middleware automatically injects the active tenantId into every read and write — even if a service forgets to add it, the middleware refuses the query without it.
- Per-tenant Postgres row-level controls
- Tenant-bound entities are queryable only with the active tenant context. The escape hatch (PrismaService.unscoped) is auditable, alarmed, and used only for platform-administration paths.
- Cross-tenant isolation E2E spec
- A Playwright spec runs in CI on every change. It logs in as two separate tenants and exhaustively asserts that neither can read, mutate, or enumerate the other’s data through any documented endpoint.
Hosting & data residency
Hosted in Riyadh, Kingdom of Saudi Arabia.
The production platform runs in the Alibaba Cloud Riyadh region. Tenant data — including database, file storage, backups, and AI embeddings — never leaves the Kingdom in normal operation.
- Primary region
- Alibaba Cloud Riyadh (me-east-1). Production database, application servers, object storage, and DR snapshots are all KSA-resident.
- Encryption in transit
- TLS 1.2+ enforced for every public endpoint. Internal service-to-service traffic uses mTLS where supported by the runtime.
- Encryption at rest
- AES-256 at the storage layer for Postgres, object storage, and snapshots. Per-tenant encryption-key envelope on the roadmap for the Dedicated Cloud tier.
- Sub-processors
- A current sub-processor list is published with the Data Processing Agreement. Sub-processors are limited to infrastructure (Alibaba), AI model serving (Anthropic), and transactional email (SMTP provider) — all under explicit DPAs.
- Deployment models
- For customers with stricter sovereignty or air-gapped requirements: Dedicated Cloud (single-tenant on customer cloud) and On-Premises (customer-managed infrastructure) options are available with the same codebase.
Security controls
NCA ECC-aligned controls, mapped to code.
Controls from the National Cybersecurity Authority Essential Cybersecurity Controls (NCA ECC) are mapped to specific platform behaviours, not just policy documents. Below is a representative subset; a full crosswalk is available on request as part of the compliance pack.
- Identity, authentication, and access (ECC-2-3)
- Password complexity enforcement, optional MFA via TOTP, SSO/SAML in the Enterprise tier, role-based access control with module-level entitlements, force-change-password on first login.
- Audit logging (ECC-2-12)
- Every state-changing API call is logged with tenantId, userId, entity, action, timestamp, and source IP. The interceptor is decorated onto controllers — coverage is verified at build time, not assumed.
- Vulnerability management (ECC-2-10)
- Dependency CVE scanning runs in CI on every change. Container images are scanned with Trivy at build. A documented findings register tracks known issues by severity with remediation owners.
- Network segmentation
- Public ingress is restricted to the application gateway. Database, queue, and AI services are reachable only from application containers within the private network.
- Secrets management
- Production secrets are stored in an encrypted secrets vault with 90-day rotation policy. Application containers receive secrets at runtime, not baked into images.
Compliance
PDPL aligned. ISO 27001 ready. Audit-ready by design.
We do not claim certifications we have not earned. Each posture below reflects what is implemented today and what is on the certification roadmap.
- Personal Data Protection Law (PDPL)
- A Data Processing Agreement is published and signed with every paid tenant. The breach-notification runbook follows the 72-hour SDAIA requirement. A documented Data Subject Access Request workflow generates per-subject reports in under 100ms. DPO contact: dpo@nexteam.me.
- NCA Essential Cybersecurity Controls (ECC)
- A controls crosswalk maps each ECC control to the corresponding platform behaviour, configuration setting, or operational runbook. Available on request as part of the compliance pack.
- ISO 27001 readiness
- Information security management documentation, asset inventory, risk register, access control matrix, and incident response procedures are maintained per the ISO 27001 framework. We are aligned, not yet certified — formal certification is on the 2026–2027 roadmap.
- SOC 2 alignment
- Engineering practices follow SOC 2 Type II patterns (change management, logical access, change in production, system monitoring). A formal SOC 2 audit will follow ISO 27001 certification on the same roadmap.
- Independent penetration testing
- An annual third-party penetration test is scheduled. Findings flow into the same register that tracks internal vulnerability findings, with remediation SLAs by severity.
Operations & continuity
Backups, DR, and incident response — tested.
Continuity is treated as code, not policy. Backups are tested by restore. DR procedures are exercised. Incident response is a runbook, not a phone tree.
- Backups
- Postgres Point-in-Time Recovery enabled with continuous WAL archiving. Daily logical dumps to object storage. Restore tested quarterly into an isolated environment.
- High availability
- Multiple backend instances behind a load balancer. Managed Postgres with synchronous replication. Static assets served from the CDN edge. Health endpoints monitored externally.
- Disaster recovery
- RPO target: 15 minutes (continuous WAL archive). RTO target: 4 hours for full region restoration from snapshots. DR drill schedule documented in the operations runbook.
- Incident response
- A 72-hour SDAIA breach-notification runbook is documented and accessible to on-call staff. A tenant-admin notification template is pre-staged. Severity-driven communication cadence (initial / interim / resolution).
- Change management
- Every production change goes through a pull request, automated tests, security and dependency scans, and a documented release. Production access is gated, logged, and audit-trailed.
Artifacts
Available on request, under NDA.
The following procurement artifacts are available to qualified enterprise prospects and customers. Some are public; some require an NDA in advance.
Talk to us about your security review.
Whether you are filling in a security questionnaire, scoping a procurement, or planning a deeper architectural review, we are happy to meet your team and walk the controls together.