Security
Security is built into how FleetSijil is designed, not added on afterwards.
Tenant isolation
Every customer’s data is separated at the database level with PostgreSQL row-level security, so one organization can never read another’s records.
Authentication & MFA
Sign-in is handled by a dedicated identity provider (Zitadel), with two-factor authentication (TOTP) required for owner and admin accounts.
Encryption
Traffic is encrypted in transit with TLS, and credentials are never stored in plain text.
Least privilege
The application connects to the database as a least-privilege role; cross-tenant access is reserved for tightly-scoped platform operations.
Auditability & PDPL
Sensitive actions are recorded in an audit log, and data lifecycle (export and retention purge) is built in, PDPL-aware by design.
Report an issue
Found something? Please email security@fleetsijil.sa — we take reports seriously.