A security posture you can audit, not just trust.

1. Scope

This document covers the production environment that processes customer requests: the Fastify API, the Next.js marketing + dashboard surface, the BullMQ worker fleet, the Postgres + Redis data tier, and the S3-compatible object stores in each region. It does not cover internal employee tooling (HRIS, payroll, etc.), those are scoped under our SOC 2 organisational controls and listed separately on /compliance.

2. Encryption

In transit

TLS 1.3 end-to-end, with TLS 1.2 disabled at the edge. HSTS is preloaded for tryhakim.ai and *.tryhakim.ai with a 1-year max-age and the includeSubDomains; preload directives. Internal service-to-service calls inside the VPC also run over mTLS, a leaked credential alone is not enough to read traffic.

At rest

AES-256-GCM on every Postgres volume (RDS-managed KMS), every S3 bucket (SSE-KMS, separate CMK per region), and every backup snapshot. Encryption keys are never stored alongside the data they protect, are rotated annually, and can be rotated immediately on a confirmed compromise without re-encrypting the underlying ciphertext.

Field-level

TOTP shared secrets are wrapped with a separate AES-256-GCM key (TOTP_SECRET_KEY) before they hit the database, so an exfiltrated database dump alone cannot bypass two-factor authentication. The same envelope-encryption pattern protects long-lived API key secrets on enterprise plans.

3. Access control

Production access is restricted to a named on-call rotation, gated behind FIDO2 hardware keys (no SMS, no TOTP) plus IP allowlisting from our office and corporate VPN. Every command run against a production resource is logged through the IAM session manager and ingested into our SIEM with a 365-day retention. The on-call lead reviews the previous week's session log every Monday, a deviation that isn't tied to a ticket gets escalated to the security lead the same day.

4. Authentication & authorization

Customer-facing authentication is Auth.js v5 with email magic links, OAuth (Google), and FIDO2 passkeys. TOTP is offered as a fallback because some enterprise environments still ban WebAuthn at the device-management policy layer. Authorisation inside the dashboard runs through a per-organisation role table (owner/admin/member/billing) that is enforced server-side on every action, the UI hides controls you cannot use, but the server is the source of truth.

5. Network architecture

The production fleet runs in private VPC subnets with no public IPs. Ingress flows through an AWS WAF tier with managed rule sets (OWASP Top 10, AWS Bot Control) tuned to our traffic, then a load balancer that terminates TLS, then the application targets. Egress is restricted to a documented allowlist (Stripe, Resend, hyperscaler internal endpoints). Cross-region traffic stays inside AWS' private backbone, we never route customer audio over the public internet between regions.

6. Application security

Every PR runs through pnpm tsc, the eslint security plugin, pnpm audit, and a gitleaks secrets scan before review. The web app ships a strict CSP (default-src 'self'), X-Frame-Options: DENY, Referrer-Policy: strict-origin-when-cross-origin, and a narrow Permissions-Policy allowlist. Critical cookies are __Host- prefixed with Secure; HttpOnly; SameSite=Strict. CSRF is enforced on every state-changing route via __Host-hakim-csrf. We use parameterised queries via Prisma, no string-concatenated SQL ships.

7. Data residency

You pick a region at workspace creation time. Today we operate four live regions: dedicated GCC regions in the UAE, KSA, and Qatar with regional partners, plus EU-Frankfurt (eu-central-1) on AWS. Customer content stays inside the chosen region, there is no silent cross-region routing. Account-level metadata (emails, billing addresses) lives in GCC-UAE for all customers because that's where the billing system is homed; we disclose this up-front rather than make an unkeepable blanket promise.

8. Audits & certifications

SOC 2 Type II audit is engaged with a Big-4 auditor; the observation window opened in 2026 and the report is expected late this year. ISO 27001 readiness assessment is complete and remediation is in flight. GDPR Article 32 is documented in our DPA, with an EU representative on file. Our HIPAA posture covers the technical safeguards but we do not yet sign BAAs at scale, talk to compliance@tryhakim.ai if you need one. KSA and UAE compliance posture (NDMO, NCA ECC, NESA) is documented under enterprise contracts.

9. Penetration testing

We engage an independent firm to run a black-box and grey-box pen-test against the API and dashboard every quarter, with a fresh scope and a fresh tester each time. Findings are triaged within 72 hours, criticals are patched inside two weeks, and the executive summary is shared with enterprise customers under NDA on request. Our most recent test cycle closed in March 2026 with zero criticals or highs.

10. Vulnerability disclosure

We run a coordinated disclosure programme at security@tryhakim.ai (PGP key on /well-known/security.txt). Reports get an acknowledgement within 24 hours and a resolution target inside 14 days for high-severity findings. We do not currently run a paid bounty programme, but we publish a hall-of-fame and write thank-you references on request. Safe-harbour: good-faith research that follows our policy will not be subject to legal action.

11. Incident response

Our IR runbook is exercised quarterly with a paper drill and twice a year with a live-fire simulation. On a confirmed customer-content incident we commit to: (a) a notification to affected workspace owners within 24 hours, (b) a public root-cause analysis on /changelog within 7 days, and (c) a post-mortem with action items shared in the same window. Severity 1 incidents page the on-call engineer within 60 seconds via a redundant alerting path (PagerDuty + email + SMS).

12. Sub-processors

The complete sub-processor inventory, including the data each one touches, the region it operates in, and the contractual basis, lives at /compliance with its own change-notification track. Material additions are announced 30 days before they go live so customers can object. We do not silently swap a sub-processor; if one is removed for cause we publish the reason.

13. Contact

Security reports: security@tryhakim.ai (PGP available). Compliance questionnaires: compliance@tryhakim.ai. Procurement: privacy-trained engineers respond inside two business days. For postal correspondence, email legal@tryhakim.ai and we'll share the registered address for the United Arab Emirates entity.