← Back

Security

Saihi is built privacy-first. The controls below describe our current security posture and the roadmap for enterprise readiness.

Today
Row-level security

Every record is scoped to its owning account at the database layer.

Encryption in transit

TLS on all client ↔ server and server ↔ provider connections.

Encryption at rest

Managed database and storage use provider-managed encryption.

Authenticated access

All server functions require a valid bearer token from a verified session.

Audit logging

Sensitive actions (deletions, exports, account events) are recorded in an immutable audit log.

Least-privilege admin

Admin tooling is gated by an explicit role check in a security-definer function.

Roadmap
  • SOC 2 Type IIPlanned
  • Single Sign-On (SAML)Planned
  • Customer-managed encryption keysPlanned
  • Audit log exportPlanned
  • Penetration testing reportsPlanned
  • Bug bounty programPlanned
Responsible disclosure

Found a vulnerability? Please report it privately to security@saihi.ai. We’ll acknowledge within a reasonable timeframe and keep you informed through resolution.

See also: Privacy Policy · Terms & Conditions · Data Ownership · Compliance