Security at Vortex360

Security is built in, not bolted on

We handle sensitive financial, HR, and operational data for businesses across the Middle East. Security isn't an afterthought — it's at the core of every decision we make.

SOC 2Readiness in progress
ISO 27001In progress
GDPREU Data Regulation
PDPLSaudi Data Regulation

Our security pillars

A layered security approach covering every aspect of the platform.

Encryption

  • All data encrypted at rest using AES-256
  • TLS 1.2+ enforced for all traffic in transit
  • Database backups encrypted before storage
  • Passwords hashed with bcrypt (cost factor 12)

Authentication & Access

  • Signed JWT sessions with configurable expiry and server-side revoke
  • Role-Based Access Control (RBAC) with granular permissions
  • Optional TOTP multi-factor authentication with backup codes
  • Account lockout and login rate limiting on failed sign-in attempts
  • SSO via OAuth 2.0 (Google, Microsoft, Facebook) and directory login options

Infrastructure

  • Hosted on Microsoft Azure with 99.9% SLA
  • Automated database backups with configurable retention
  • Network-level DDoS protection
  • Private VNet with strict ingress/egress rules

Audit & Monitoring

  • Append-only application audit trail for sensitive actions
  • Centralised application logging (Seq) when configured
  • Executive Override Logging for high-privilege actions
  • Configurable audit retention in tenant compliance settings

Application Security

  • OWASP Top 10 mitigations applied
  • Input validation and parameterised queries throughout
  • CSRF protection on all state-changing endpoints
  • CI gates including RBAC route enforcement checks

Compliance & Testing

  • SOC 2 readiness program underway (Security criteria)
  • Security reviews as part of our engineering process
  • GDPR and PDPL (Saudi) data-handling controls in product
  • Documented subprocessors for hosting, payments, and email

Responsible Disclosure

Found a vulnerability? We appreciate responsible reporting.

If you discover a potential security issue in Vortex360, please report it to us privately before any public disclosure. We commit to acknowledging your report within 24 hours, providing a resolution timeline within 5 business days, and not taking legal action against researchers who follow this policy.

Have security questions?

Our security team is happy to answer questions from prospective enterprise customers, auditors, or compliance teams.