Security
SAR Portal implements security measures to protect your data and help you comply with GDPR.
Authentication
How You Sign In
Your users sign in with their organisation’s Microsoft 365 account, their Google account or a one-time code sent to their email. SAR Portal stores no passwords and adds no multi-factor step of its own. Any multi-factor step comes from the user’s own provider: Google sign-ins follow the Google account’s multi-factor settings, and for Microsoft 365 it depends on how your organisation’s tenant treats sign-ins to an outside application, so test it rather than assume it. The email code is a single factor that relies on how the mailbox is protected. We recommend that you require multi-factor authentication on these accounts and mailboxes.
Session Security
- Sign-in has a 24-hour sliding session limit (enforced at sign-in and on new connections, not on an already-open session)
- If someone is removed from your organisation or invited to another one, their session ends on their next request, and within about 5 minutes in an open tab
- Secure token handling
Data Security
Encryption at Rest
All data is encrypted using:
- AES-256 encryption
- Microsoft-managed encryption keys
- Microsoft Azure infrastructure
What’s encrypted:
- Case data
- Documents
- User information
- Audit logs
Encryption in Transit
All data transmission uses:
- TLS 1.2 or higher
- HTTPS only
- Certificate validation
- Strong cipher suites
Data Residency
Case data and documents are stored in Microsoft Azure West Europe (Netherlands), with a second copy of documents in North Europe (Ireland). AI processing runs in Azure Sweden Central. Case content stays in the EEA. A few supporting services may process limited account, billing or technical data outside the EEA under Standard Contractual Clauses or the EU-US Data Privacy Framework: Microsoft Graph (your users’ names and emails, for invitations), Google reCAPTCHA (browser signals from people using our website forms and application pages, including your request forms) and Stripe (billing). None of them receive case content or documents. Microsoft Entra External ID keeps directory data in the EU, and Twilio SendGrid email is sent from its EU regional account; their terms allow limited transfers outside the EEA, for example security and fraud signals or vendor support in exceptional cases, under SCCs.
Access Control
Role-Based Access
Users only see what their role permits:
- Admins: Full access
- Case Managers: Case operations
- Reviewers: Limited editing
- Read Only: View only
Tenant Isolation
Each organization’s data is logically isolated:
- Every record is partitioned by your tenant ID
- Every query is limited to your tenant
- No cross-tenant access
Infrastructure Security
Cloud Platform
Built on Microsoft Azure:
- Hosted on Microsoft Azure, which holds ISO 27001 and SOC 2 certifications (SAR Portal itself is not certified)
- Periodic security reviews
- Azure platform DDoS protection
Network Security
- HTTPS only
- Rate limiting
- Azure platform DDoS protection
Monitoring
- Automated security alerts around the clock (Microsoft Defender for Cloud), sent to our directors
- Incident response procedures
- Periodic security assessments
Application Security
File Security
Documents are protected by:
- Malware scanning on upload (Microsoft Defender for Storage)
- Deep file type validation
- Size limits
- Secure storage
Rate Limiting
Protection against abuse:
- Public API endpoints are rate-limited
- Sensitive operations have stricter limits
- Automatic blocking of excessive requests
Input Validation
All user input is:
- Validated on client and server
- Sanitized before storage
- Protected against injection attacks
Your Security Responsibilities
Account Security
- Protect the Microsoft 365 account, Google account or mailbox you sign in with
- Turn on multi-factor sign-in for that account
- Don’t share credentials
- Log out on shared devices
User Management
- Remove access promptly when staff leave
- Use principle of least privilege
- Review user access regularly
- Monitor for unusual activity
Data Handling
- Don’t download unnecessary data
- Secure your local devices
- Report suspicious activity
- Follow your organization’s policies
Security Features by Plan
| Feature | Basic | Starter | Pro |
|---|---|---|---|
| Encryption | Yes | Yes | Yes |
| Role-based access | Yes | Yes | Yes |
| Audit logs | Yes | Yes | Yes |
| Rate limiting | Yes | Yes | Yes |
| Sign in with Microsoft 365, Google or email code | Yes | Yes | Yes |
Reporting Security Issues
If you discover a security vulnerability:
- Email security@sarportal.com
- Provide detailed description
- Don’t publicly disclose
- We’ll respond promptly
Security & Compliance
Hosted on Microsoft Azure, which holds ISO 27001 and SOC 2 certifications. SAR Portal itself is not ISO 27001 or SOC 2 certified; we hold Cyber Essentials and Cyber Essentials Plus (independently audited). Data is encrypted in transit and at rest with Microsoft-managed keys, and application secrets are kept in Azure Key Vault. Every uploaded file is scanned for malware by Microsoft Defender for Storage. The database has continuous backup with 7-day point-in-time restore.
- Built to help you comply with GDPR
- Built with privacy by design