Security
Security built into the kernel, not bolted on
Every request takes the same path through the permission engine, whether it came from a person, a form, a webhook or an agent.
In the kernel today
- Row-level security in PostgreSQL and a tenant predicate in every generated query — two independent layers
- The permission engine on every read and write, including from functions and agents
- Extensions in a WebAssembly sandbox with capability-based access, fuel and memory limits
- Refresh tokens rotated on every use; reuse ends the session
- A strict Content-Security-Policy on the web app, and nothing loaded from third parties
- Uploads scanned for malware before they are kept, and served only through short-lived signed links
- An append-only event log for every change, and a complete audit trail
Designed, being built
- Cells as blast-radius boundaries, with each tenant pinned to its region
- Network egress from functions only to allow-listed hosts, through a logging proxy
- Per-tenant keys for sensitive fields, and bring-your-own-key for enterprises
Compliance targets
These are targets on the roadmap. Zanfira holds no certifications today, and this page will list each one only once it has been issued.
| Phase | Target |
|---|---|
| Beta | PDPL controls (Saudi Arabia and Egypt); NCA ECC controls mapped; SOC 2 Type I |
| General availability | SOC 2 Type II; ISO 27001; CSA STAR; GDPR readiness for EU cells; certified ZATCA integration |
| Scale | SAMA CSF alignment for fintech tenants on dedicated cells |
Data residency
Each tenant is designed to carry an immutable region: the router refuses to place or move it elsewhere, backups stay in the region, and support access is logged and time-boxed.
Reporting a vulnerability
A disclosure process with a dedicated address will be published before general availability. Until then, use the contact on the about page. About and contact