Most platforms ask you to take their security on faith. We'd rather show you exactly what is implemented today, what is in progress, and what is still on the roadmap — and give you the documents to check.
Every claim on this page maps to code or a documented process. Where something is not done yet, we say so.
Rich Life Trading Company (Exomations) is registered and active on the National Data Governance Platform of the Saudi Data & AI Authority (SDAIA). Scan the QR code on the certificate to verify it.
Registration No.: 3260008321 · Issued: 2026-09-24
Controls that are enforced in production right now — not aspirations.
Connection credentials and OAuth tokens are encrypted in the database with AES-256-GCM.
All traffic is served over HTTPS with HSTS (2-year, includeSubDomains, preload).
Every database query is scoped to a single tenant — no tenant can read another's data.
Five roles, from super owner to viewer, are enforced server-side for every privileged action.
Our logging pipeline redacts personal identifiers — emails, phone numbers, IBANs, and national IDs — before they reach application logs.
Logins, role changes, billing, and data requests are recorded and retained for one year.
A three-tier limiter protects login, API, and webhook surfaces from abuse.
Inbound payment webhooks are verified before any billing state changes — by HMAC-SHA256 signature, or by a direct server-to-server query to the provider.
Idempotency keys prevent the same operation from being executed twice.
Passwords are hashed with bcrypt (cost factor 12); plaintext is never stored.
Access to our own data store uses parameterized queries — request values are passed as bound parameters, not concatenated into SQL strings.
Encryption keys, database credentials, and provider tokens are stored as environment secrets, never committed to source code.
Keys are prefixed with exo_ and cryptographically hashed before storage — never kept in plaintext. A key is therefore shown once, at creation: re-displaying it is impossible, not merely disallowed.
JWT access + refresh tokens with automatic rotation
Require a 6-digit email code when signing in from a new device
Enterprise controls by default. Full detail on the Trust page.
Connection HTTP nodes include automatic protection mechanisms that prevent cascading failures when external APIs become unavailable.
What we have earned, what is in motion, and what we have not done yet.
AES-256-GCM at rest for sensitive fields; HTTPS + HSTS in transit.
Lawful basis, security controls, and data-subject rights (DSAR) are live. Sector-specific residency rules may add requirements.
Controls are mapped to the NCA Essential Cybersecurity Controls; many are enforced in code, governance documentation is in progress.
Per-tenant query scoping and server-side role checks on every privileged route.
Not yet audited. We will not display a SOC 2 badge until an independent audit is complete.
Targeted after SOC 2; the underlying control mapping work is already underway.
SOC 2 Type II and ISO 27001 are on our roadmap — we are not yet audited, and we will not display a badge we have not earned. Ask us for our current control mapping (NCA ECC-2:2024) and we will share it.
Built to meet the highest standards of compliance and security for the Saudi and MENA enterprise market.
SOC 2 Type II — Roadmap
On our certification roadmap — controls implemented, not yet independently audited. We won't display a badge we haven't earned.
ISO 27001 — Roadmap
Practices follow the ISO 27001 framework; certification targeted after SOC 2. Current mapping: NCA ECC-2:2024.
PDPL Aligned
Full compliance with the Saudi Personal Data Protection Law for data sovereignty and privacy.
GDPR Ready
Data processing controls and privacy safeguards meeting European GDPR requirements.
Saudi Data Residency
Production runs in-Kingdom on STC Cloud in Riyadh — your platform data is stored and processed inside Saudi Arabia. See our Trust page for the verified, current status.
We tell you exactly where your data lives — no vague assurances.
Exomations runs on STC Cloud infrastructure in Riyadh, Saudi Arabia — your platform data is stored and processed inside the Kingdom. Data is logically isolated per tenant and sensitive fields are encrypted with AES-256-GCM, aligned with PDPL expectations for commercial data.
Need contractual guarantees beyond standard hosting? We provision a dedicated, isolated database instance — in-Kingdom or in a GCC region you nominate — as a contractual commitment. The migration touches only the connection string; your data model is unchanged.
Platform data is hosted inside Saudi Arabia. One honest caveat: when you connect third-party services (a global AI provider, an overseas SaaS API), the data you send through those connectors is processed wherever that provider operates. We state this plainly rather than promise more than any integration platform can keep.
The day-to-day practices behind the controls.
Independent code review
Major changes go through an independent architect review before they ship.
Continuous scanning
Dependency, SAST, and secrets scanning catch vulnerabilities early.
Incident response
Security incidents are tracked with a documented process aligned to PDPL breach-notification timelines (SDAIA, 72 hours).
Durable audit record
An append-only audit trail keeps a tamper-evident record of security-relevant events.
Tell us what you need to verify. We will send our control documentation or set up a call with someone who built the platform.
Every layer of Exomations is designed for enterprise security requirements.
Encrypted Credential Vault
AES-256 encrypted storage for all API keys and credentials
Scoped API Keys
Generate scoped API keys for external integrations, with optional expiry and instant revocation
Token-Based Authentication
JWT access + refresh tokens with automatic rotation
Full Tenant Isolation
Complete data separation between organizations
Per-Plan Rate Limiting
Protect platform resources with tenant-scoped limits
Immutable Audit Trail
Every action logged and tamper-proof for compliance
encryption: military-grade
api_keys: one-time display, hashed
auth: token-based (access + refresh)
passwords: cryptographically hashed
tenant_isolation: complete separation
rate_limit: per-plan enforcement
credentials: encrypted at rest
audit: immutable append-only
Enterprise controls by default. Full detail on the Trust page.
We use cookies to enhance your experience, analyze site traffic, and for security purposes. By continuing to use our platform, you consent to our use of cookies in accordance with our Privacy Policy.