Security & compliance
Security tested every quarter, with zero tolerance.
ISO 27001 and ISO 27701 certified, built to the OWASP Top 10 and ready for SOC 2 Type II. SARBOnline complies fully with VAPT security norms. It is scanned every quarter with IBM Security AppScan Standard and Burp Suite, with zero tolerance for high and medium-risk findings.
27001
27701
TOP 10
TYPE II
Passwords and keys
Hashed and encrypted with SHA-2. Configuration secrets, including database connection strings, are stored encrypted with AES.
Stored documents
Slips, attachments and emails are kept encrypted with AES on the SARB server. Disk encryption is supported on application and database servers.
In transit
TLS between browser, application and database. Request and response payloads carry an additional encryption layer and anti-forgery headers.
Single sign-on
Microsoft Entra ID (MSAL) and Okta supported. Role-based access by team, office and geography with full data segregation.
Audit trail
Every change on every record is logged with user and time. Application and security events are written to a structured log store.
Where your data lives
Hosted by Simson or deployed on your own servers to meet local data-residency rules in every market you operate in.
Testing programme
What "zero tolerance" means in practice.
Every quarter the application is scanned end to end. Any finding rated high or medium blocks the release until it is fixed and re-tested. Low findings are tracked to closure.
- Tools: IBM Security AppScan Standard for dynamic scanning, Burp Suite for manual penetration testing.
- Scope: authentication, session management, input handling, access control, encryption and configuration.
- Reports: a summary of each quarter's findings and closure is available to customers under NDA.
- Customer testing: you may run your own VAPT against a staging environment by arrangement.
| Control | How SARBOnline meets it |
|---|---|
| Access control | Roles, teams and office scoping; SSO via Entra ID or Okta; per-screen rights. |
| Encryption at rest | AES for documents and secrets; disk encryption on servers. |
| Encryption in transit | TLS end to end, plus payload encryption between browser and API. |
| Logging and monitoring | Structured application and security logs; health checks on database and services. |
| Vulnerability management | Quarterly VAPT; high and medium findings block release. |
| Information security | ISO 27001 certified information security management system. |
| Privacy | ISO 27701 privacy information management; data residency by deployment choice. |
| Application security | Designed and tested against the OWASP Top 10: injection, broken access control, cryptographic failures and the rest. |
| SOC 2 Type II | Controls for security, availability and confidentiality mapped to the Trust Services Criteria; ready for a Type II audit period. |
| Availability | Enterprise SLA with 24/7 support; backup and restore procedures agreed at implementation. |
Nothing to install
SARBOnline runs in the browser.
No client software to install, patch or secure on each desk. Updates reach every office at once, and your IT team manages one server estate instead of hundreds of workstations.
Need the security questionnaire filled in?
Send us your due-diligence pack. We return completed questionnaires, certificates and the latest VAPT summary under NDA.