Trust and compliance
How Ijtimaa lines up with the Saudi NCA Essential Cybersecurity Controls, ISO/IEC 27001 and SOC 2.
This is our own self-assessment. Ijtimaa is not certified to ISO/IEC 27001 and has no SOC 2 report from an auditor yet. Use this page to see what the software does, and what you need to do on your side, when you prepare your own assessment.
- Built into Ijtimaa
- Depends on how the server is run (you or your hosting provider)
- Not done yet: on our list
NCA Essential Cybersecurity Controls (ECC)
The ECC has four main domains that apply to a service like this. We list what Ijtimaa does for each.
| GovernanceDomain 1 | Self-hosted: the database, recordings and backups stay on the server you choose, in the Kingdom if you host there. You set the data location shown to users. Your organisation still owns its policies, risk register and reviews. | Shared |
|---|---|---|
| Identity and accessDomain 2 | Passwords hashed with scrypt; two-step sign-in (authenticator app) with recovery codes; company sign-in with Microsoft, Google or any SAML identity provider (ADFS, Okta, Entra ID); automatic user provisioning and removal (SCIM); workspace roles (admin, member); a workspace can require company sign-in for members. | Built in |
| Protecting data in transit and at restDomain 2 | HTTPS everywhere (automatic certificates); meeting audio and video encrypted in transit (DTLS-SRTP); saved secrets such as mail passwords, stream keys and calendar tokens encrypted with AES-256-GCM; optional end-to-end encrypted meetings, where even the video server can’t see or hear the meeting. | Built in |
| Disk encryption and hardeningDomain 2 | Encrypting the server disk, firewall rules and operating-system updates are done on the server. Our setup script turns on the firewall and automatic security updates. | Shared |
| Monitoring and incident responseDomain 2 | A built-in watchdog checks the app, database, video server, disk and backups and emails the owner. Owner-portal sign-ins and changes are logged. Your team runs the incident process. | Shared |
| Resilience and backupsDomain 3 | Nightly database backups are restored into a test database to prove they work; recordings are snapshotted; an off-server copy can be turned on. 14 days are kept. | Built in |
| Third parties and cloudDomain 4 | No outside AI, captions or video services: speech-to-text, summaries and translation run on the same server. Outside services are only used if you connect them (your email server, calendars, SMS). | Built in |
ISO/IEC 27001:2022, Annex A
The Annex A controls that a meeting and booking service can meet in the software itself.
| Access control and authenticationA.5.15, A.5.17, A.8.5 | Role-based access per workspace; two-step sign-in; company sign-in (SSO); sessions expire and can be signed out; rate limits on sign-in. | Built in |
|---|---|---|
| Cloud services and suppliersA.5.19, A.5.23 | Runs on your own server; no data sent to other providers unless you connect one. | Built in |
| Privacy and personal dataA.5.34 | Guests’ data is only used for the booking; each workspace sets how long recordings, chat, captions, files and AI notes are kept; admins can export everything, and each person can download or delete their own data. | Built in |
| BackupsA.8.13 | Nightly, tested by restoring; off-server copy optional. | Built in |
| Logging and monitoringA.8.15, A.8.16 | Owner actions are logged and the server is watched. A full activity log that workspace admins can search isn’t built yet. | Not yet |
| CryptographyA.8.24 | TLS for web and video; AES-256-GCM for stored secrets; signed links for invitations. | Built in |
| Secure development and testingA.8.25, A.8.28, A.8.29 | Every change runs our end-to-end test suites (hundreds of checks), including access checks between workspaces. | Built in |
| Independent testingA.5.35, A.8.8 | Our own security testing runs on every change (dependency audit, static analysis, and attack tests on every API: sign-in, cross-site requests, workspace isolation, injection, SSRF, token tampering). No penetration test by an outside firm yet. | Not yet |
SOC 2 Trust Services Criteria
How the software supports each criterion. A SOC 2 report needs an auditor to test your operation over time.
| Security: logical accessCC6.1–CC6.3 | Roles, two-step sign-in, SSO, and workspace isolation enforced in every database query. | Built in |
|---|---|---|
| Security: data in transitCC6.7 | HTTPS and encrypted media; webhooks only to https:// addresses and never to private networks. | Built in |
| Security: operationsCC7.1–CC7.3 | The watchdog and alerts are built in; reviewing them and responding is your process. | Shared |
| Change managementCC8.1 | Updates are one command and roll back cleanly; approving changes is your process. | Shared |
| AvailabilityA1.2, A1.3 | Automatic restarts, health checks, tested backups and a restore script. | Built in |
| ConfidentialityC1.1, C1.2 | Recordings and notes only for the meeting host; retention limits remove old data. | Built in |
| PrivacyP1–P8 | A privacy notice, retention limits and self-service deletion are built in; your privacy policy and consent process are yours. | Shared |
What stays with you
- Encrypt the server disk and keep the operating system updated.
- Turn on two-step sign-in for every admin, and company sign-in (SSO) for staff.
- Keep an off-server backup copy, and test restoring it.
- Write down who may access recordings and how long you keep them.
Need more for your assessment?
We can share architecture notes and answer security questionnaires.
Contact us