Security

Our Security Commitment

SAR Portal is built with security integrated into every layer. We understand that you’re trusting us with sensitive personal data, and we take that responsibility seriously. This page describes the controls we have in place and how responsibility is shared between SAR Portal and our infrastructure provider.

In short: Hosted on Microsoft Azure, which holds ISO 27001 and SOC 2 certifications. SAR Portal itself is not ISO 27001 or SOC 2 certified; we hold Cyber Essentials and Cyber Essentials Plus (independently audited). Data is encrypted in transit and at rest with Microsoft-managed keys, and application secrets are kept in Azure Key Vault. Every uploaded file is scanned for malware by Microsoft Defender for Storage. The database has continuous backup with 7-day point-in-time restore.

Infrastructure Security

Cloud Platform

• Microsoft Azure: Cloud infrastructure in EU regions
• Where your data is: Case data and documents are stored in Microsoft Azure West Europe (Netherlands), with a second copy of documents in North Europe (Ireland). AI processing runs in Azure Sweden Central. Case content stays in the EEA. A few supporting services may process limited account, billing or technical data outside the EEA under Standard Contractual Clauses or the EU-US Data Privacy Framework: Microsoft Graph (your users’ names and emails, for invitations), Google reCAPTCHA (browser signals from people using our website forms and application pages, including your request forms) and Stripe (billing). None of them receive case content or documents. Microsoft Entra External ID keeps directory data in the EU, and Twilio SendGrid email is sent from its EU regional account; their terms allow limited transfers outside the EEA, for example security and fraud signals or vendor support in exceptional cases, under the Microsoft and Twilio data protection terms (SCCs). Application pages also load fonts, icons and a script library from Google Fonts, Font Awesome and jsDelivr (see our Privacy Policy).
• Backups & Redundancy: The case database runs in a single Azure region, West Europe, and has continuous backup with 7-day point-in-time restore; its backups are also held in West Europe. Documents are stored geo-redundantly, with a second copy in North Europe (Ireland).
• Uptime: Enterprise contracts include a 99.5% monthly uptime commitment; on other plans 99.5% is our target, not a guarantee. Availability is checked automatically every 5 minutes.

Encryption

• In Transit: TLS 1.2+ with HTTPS enforced via HSTS. All cookies marked Secure
• At Rest: AES-256 encryption for all stored data (Microsoft-managed keys)
• Secrets: Application secrets are kept in Azure Key Vault. Data at rest is encrypted with Microsoft-managed keys
• PII Hashing: Salted cryptographic hashing for post-anonymisation compliance verification
• File Integrity: Cryptographic hash computed on every uploaded document and kept in the audit log for your organisation’s audit-log retention period (7 years by default)

Security Headers

All responses include security headers to protect against common web vulnerabilities:

• Content-Security-Policy (allowlist of permitted script, style, font and frame sources)
• Strict-Transport-Security (HSTS, 6-month max-age)
• X-Frame-Options (SAMEORIGIN), except the embeddable public request form, which you can place on your own website
• X-Content-Type-Options (nosniff)
• X-XSS-Protection
• Referrer-Policy (strict-origin-when-cross-origin)
• Permissions-Policy (disables unused browser APIs)

Threat Detection & Malware Scanning

• Microsoft Defender for Storage v2 — every uploaded document is scanned for malware on upload by Microsoft’s malware engine running in the same EEA region as the storage account (West Europe / Netherlands). File content does not leave the EEA. Scan results are tagged on each blob. A file found to contain malware is soft-deleted from storage on detection, so it is no longer available, and it stays recoverable for 14 days in case of a false detection. SAR Portal does not hold a file back while the scan runs. We review flagged files and tell affected customers under our incident process.
• Sensitive data threat detection — Defender for Storage samples the production storage account for Microsoft Purview sensitive-information types, in the same EEA region, so security alerts on data containing personal information are prioritised. It does not label or tag individual documents.
• Microsoft Defender for Cloud (Standard tier) — continuous threat detection, security recommendations and anomalous-activity alerts (for example unusual Key Vault access, unusual database access or suspicious Azure management operations) across App Service, Key Vault, Cosmos DB and Azure Resource Manager, with Defender for Storage on the production storage account as described above. Defender for Cloud data is managed by Microsoft under the Microsoft Products and Services Data Protection Addendum.

Email Domain Protection

SAR Portal protects authorised outbound email using SPF and DKIM and enforces DMARC with a reject policy for sarportal.com and its subdomains. DMARC aggregate reports are monitored to identify unauthorised sending and authentication failures.

This means messages that spoof our domain and fail authentication are rejected by receiving mail servers rather than delivered — reducing the risk of phishing and impersonation attempts made in our name against our customers.

Application Security

Authentication & Access

• Identity Management: Secure authentication via Microsoft Entra External ID (OAuth 2.0 / OpenID Connect)
• Sign-in and multi-factor authentication: Your organisation stays in control of how its people sign in. Microsoft 365 and Google users sign in with their own account, under the security settings of their provider. In our testing, a Microsoft 365 account was asked for its organisation’s password and was not offered an email code. Multi-factor authentication is set by your organisation, not by SAR Portal, which has no separate MFA setting and does not check it, so we recommend you test your policy with your own accounts. People without Microsoft 365 or Google sign in with a one-time email code, a single factor, so we recommend multi-factor authentication on those mailboxes. SAR Portal stores no passwords. Single sign-on with your own SAML or OIDC identity provider (for example Okta) is not offered at present.
• Role-Based Access Control (RBAC): Four defined roles — Admin, Case Manager, Reviewer, Read Only
• Session Management: Secure cookies with automatic timeout. If someone is removed from your organisation or invited to another one, their session ends on their next request, and within about 5 minutes in an open tab

Input Validation & File Security

• Deep File Validation: Uploaded files verified against actual content type (not just extensions)
• File Size Limits: Enforced per-file and per-request limits
• Path Traversal Prevention: Blob storage paths validated against malicious patterns
• Filename Sanitisation: Dangerous patterns rejected with character limits enforced
• reCAPTCHA Enterprise: Google reCAPTCHA Enterprise checks registration, the website contact form and the public request form

Rate Limiting

Rate limiting is applied to public API endpoints, such as registration, the contact form, public downloads and verification, to prevent abuse, brute-force attacks and resource exhaustion. Specific limits vary by endpoint sensitivity. Webhooks are verified by signature.

On the public request portal, the one-time codes that confirm a requester’s email address are 6-digit, randomly generated codes, valid for 10 minutes and usable once. Each code request is checked by reCAPTCHA Enterprise, and the number of code requests and verification attempts is limited.

AI Security

• Prompt Injection Guard: Input validation and injection detection on all AI inputs
• PII Redaction: Multi-layer detection combining multiple Azure AI services
• No Training on Customer Data: Documents processed by Azure OpenAI are not used for model training. Document Intelligence deletes inputs and results 24 hours after analysis, and Microsoft’s abuse monitoring may keep prompts and responses its systems flag, in the EU (see section 5.1 of our DPA)
• Allowance Management: Per-organisation page allowance tracking, with emails at 80% and 100% and enforcement at the limit (Enterprise, under fair use: an alert at 100%, and document processing pauses at 150%)
• When your allowance is used up or AI is unavailable: Files that could not be checked for personal data are held back, not added to the case. You can include one only if you will redact it yourself before sharing. A message tells you when this happens.

Data Protection

GDPR Compliance

• Data Processing Agreement (DPA): Available for all customers — see DPA
• Privacy by Design: Tenant isolation, masking of personal data in logs (a coding rule), hashing, automatic anonymisation
• Right to Erasure: Deleting your organisation removes your cases, documents and users from our live systems straight away. Queued emails not linked to a case are removed automatically about 30 days after they were created. After a cancellation, all your data is deleted within 90 days. Backup copies expire within 14 days (files) and 7 days (database). Audit logs are pseudonymised: email addresses, IP addresses and user agents are removed, though some entries can still contain names (for example a changed contact name or a user’s display name). We keep them as an independent controller to defend legal claims. Each entry is set to expire at the end of your organisation’s audit-log retention period (7 years by default; on request we can set a period of 3 to 10 years for your organisation, which applies to entries written after the change), counted from when the entry was last written. Pseudonymising an entry restarts that period, and entries under legal hold are kept while the hold applies and for the full retention period after it is released. Irish tax law requires us to keep billing records for at least 6 years; we keep them for 7 years from the transaction date.
• Data Portability: JSON and PDF export always permitted, even under subscription restrictions (GDPR Article 20)
• Legal Hold: Blocks deletion and anonymisation when litigation is pending, with full audit trail. An organisation cannot be deleted while any of its cases is on legal hold.
• Deleted Documents: An Admin can delete a document from a case. Its file is moved to an archive in that case’s folder and can be restored while the case is open. Closing the case does not erase the archived copy; it is erased, with its earlier versions, when the case is anonymised (automatically, by default 30 days after closure; on request we can set a different period for your organisation) or deleted under your retention settings. Copies archived before 22 September 2026 under a shared file name can be kept until the last case using that name is erased, and deleted files stay in storage soft delete for 14 days.

Multi-Tenant Isolation

• Case Data: Your case, document and audit data is stored by tenant and limited to your tenant on the server, using the tenant in the signed-in user’s token. This is enforced in our application code, not by the database. A few platform functions, such as sign-in lookups, provider webhooks and scheduled jobs, read across tenants by design
• Document Storage: Documents are kept in a shared Azure Blob Storage container, in a separate folder for each tenant. Before any read, write, list or delete, the application checks that the tenant identifier is valid and that the path stays inside that tenant’s folder, with no path traversal. Download links are short-lived, read-only links issued for one file at a time
• Logical, not physical: Tenants are separated in the application and data layer within shared, EU-hosted Azure resources. There is no dedicated database, storage account or container per tenant
• Cross-Tenant Isolation: Controls are designed to prevent tenants from accessing each other’s data

PII Protection in Logs

Our coding rules require personal data (emails, phone numbers, names, financial data) to be masked with our log sanitiser before it is written to our application logs. This is a rule our code follows, not an automatic filter. Application telemetry records the signed-in user’s account identifier (Microsoft Entra object ID). Security-event logs and web server logs (kept for 3 days) include IP addresses for security.

Operational Security

Monitoring & Detection

• Real-Time Monitoring: Alerting, diagnostics, and performance tracking
• Health Monitoring: Automated verification of critical service availability
• Threat Detection: Microsoft Defender for Cloud alerts us to threats and unusual activity, and we investigate each alert (see Threat Detection & Malware Scanning above)
• Centralised Logging: Application logs; our coding rules require personal data to be masked before it is written (see PII Protection in Logs)

Incident Response

• Prompt Breach Notification: We notify affected controllers without undue delay, contractually targeting within 24 hours of becoming aware of a qualifying breach (the GDPR Article 33 72-hour deadline is the controller’s onward obligation to the supervisory authority)
• Post-Incident Review: Root cause analysis and remediation
• Breach Documentation: All incidents and actions taken are documented

Security Practices

Development

• Secure development: Security is considered at design and implementation
• Release gates: Every change is built and tested automatically, then deployed to Dev and UAT before Production, which needs manual approval
• Dependency checks: Every package restore runs the .NET SDK’s NuGet audit, which warns about packages with known vulnerabilities. Our vulnerability procedure requires us to check, at every release and at least monthly, every project’s direct and transitive packages against published vulnerability advisories. We fix or mitigate findings by severity, aiming for 24 hours (critical), 7 days (high), 30 days (medium) and 90 days (low)

Connection Security

• Connection limits and timeouts configured to prevent resource exhaustion and slow-rate attacks
• CORS policy with a named list of allowed origins (our websites only) and no wildcard origins. Local development addresses are not allowed in production

Shared Responsibility Model

SAR Portal follows the standard enterprise cloud shared responsibility model. It is important to understand which controls are provided by our infrastructure provider (Microsoft Azure) and which are implemented by us.

Compliance Posture

SAR Portal (Application Level)

• GDPR: Designed to support compliance with EU and UK data protection requirements
• Irish Data Protection: Established in Ireland; the Data Protection Commission (Ireland) is our supervisory authority
• Security Controls: Designed in alignment with recognised standards (such as ISO 27001), implemented on Microsoft Azure
• Cyber Essentials Plus: SAR Portal is operated by Sekhon IT Consultants Ltd., a Cyber Essentials Plus certified organisation — the independently audited level of the scheme (see below)
• Vendor Self-Assessment: Regular internal security assessments conducted and available on request

Note: SAR Portal itself is not independently ISO 27001 or SOC 2 certified. The controls described on this page are based on vendor self-assessment. The Cyber Essentials Plus certification is held by the operating company (Sekhon IT Consultants Ltd.), not by the SAR Portal product as a separate certified entity. The underlying Azure infrastructure is independently certified by accredited third-party auditors. For a copy of our latest security compliance statement, contact security@sarportal.com.

Cyber Essentials Plus Certification

SAR Portal is operated by Sekhon IT Consultants Ltd., which holds Cyber Essentials Plus certification — the audited level of the scheme.

Cyber Essentials is a UK Government-backed cyber security scheme, described by the National Cyber Security Centre as the minimum cyber security standard recommended by Government for organisations of all sizes. The scheme is aligned to five technical control areas: secure configuration, user access control, malware protection, security update management, and firewalls.

Cyber Essentials Plus goes a step further than the base certification: as well as the self-assessment, the five controls are verified by a qualified external assessor through a hands-on technical audit, including authenticated vulnerability scans of in-scope devices and a test of the organisation’s defences. It is the highest tier of the Cyber Essentials scheme.

This certification supports our wider security approach, alongside Microsoft Azure EU-resident hosting, encryption in transit and at rest, role-based access control, audit logging, tenant isolation and the secure data handling processes described elsewhere on this page.

Cyber Essentials Plus forms part of our security baseline. It does not, on its own, guarantee freedom from cyber security vulnerabilities, and we do not present it as such.

Certificate holder: Sekhon IT Consultants Ltd. Certification: Cyber Essentials Plus Independent verification: The certificate can be verified via the BlockMark Registry. BlockMark Registry is used by IASME for digital certificates, helping make certificates and badges secure, transparent and verifiable. Certificates can also be searched through the official IASME / NCSC Cyber Essentials certificate search.

What this means in plain English

The company that builds and operates SAR Portal has been independently audited and certified against the UK Government-backed Cyber Essentials Plus cyber security controls — the hands-on, assessor-verified level of the scheme.

SAR Portal the product is not separately certified. The certification applies to the operating organisation, Sekhon IT Consultants Ltd.

For procurement teams, the certificate is verifiable using the link above, and a copy can be supplied on request alongside our due-diligence pack.

Azure Platform Certifications (Inherited Infrastructure)

SAR Portal is built entirely on Microsoft Azure, inheriting their independently audited compliance certifications:

For the complete list of Azure certifications, see Microsoft Service Trust Portal. Microsoft commits to GDPR in its Data Protection Addendum; GDPR is not a certification.

Sub-Processor Certifications

Our sub-processors are listed in section 5.1 of our Data Processing Agreement. Each publishes its own security certifications:

• Microsoft Azure and Azure OpenAI: Microsoft Service Trust Portal
• Stripe: Stripe security
• Twilio SendGrid: Twilio Trust Center
• Google reCAPTCHA: Google Cloud compliance

Reporting Security Issues

If you discover a security vulnerability, please report it responsibly:

• Email: security@sarportal.com
• We will acknowledge your report within one business day
• We will investigate and provide updates on resolution
• We request that you do not publicly disclose the issue until we’ve had a chance to address it

Questions?

For security-related questions:

• Security Team: security@sarportal.com
• Data Protection Officer: dpo@sarportal.com