Security

SAR Portal implements security measures to protect your data and help you comply with GDPR.

Authentication

How You Sign In

Single sign-on (SSO) via Microsoft & Google: your users sign in with their existing Microsoft 365 or Google account. A one-time email code is also available.

Session Security

• You are signed out after 24 hours without activity
• Secure token handling

Data Security

Encryption at Rest

All data is encrypted using:

• AES-256 encryption
• Microsoft-managed encryption keys
• Microsoft Azure infrastructure

What’s encrypted:

• Case data
• Documents
• User information
• Audit logs

Encryption in Transit

All data transmission uses:

• TLS 1.2 or higher
• HTTPS only
• Certificate validation
• Strong cipher suites

Data Residency

Case data and documents are stored in Microsoft Azure West Europe (Netherlands), with a second copy of documents in North Europe (Ireland). AI processing runs in Azure Sweden Central. A few supporting services work outside the EU under Standard Contractual Clauses or the EU-US Data Privacy Framework: Microsoft Graph (your users’ names and emails, for invitations), Google reCAPTCHA (browser signals from people using your request forms) and Stripe (billing). None of them receive case content or documents.

Access Control

Role-Based Access

Users only see what their role permits:

• Admins: Full access
• Case Managers: Case operations
• Reviewers: Limited editing
• Read Only: View only

Tenant Isolation

Each organization’s data is logically isolated:

• Every record is partitioned by your tenant ID
• Every query is limited to your tenant
• No cross-tenant access

Infrastructure Security

Cloud Platform

Built on Microsoft Azure:

• Hosted on Microsoft Azure, which holds ISO 27001 and SOC 2 certifications (SAR Portal itself is not certified)
• Periodic security reviews
• Azure platform DDoS protection

Network Security

• HTTPS only
• Rate limiting
• Azure platform DDoS protection

Monitoring

• Automated security alerts around the clock (Microsoft Defender for Cloud), sent to our directors
• Incident response procedures
• Periodic security assessments

Application Security

File Security

Documents are protected by:

• Malware scanning on upload (Microsoft Defender for Storage)
• Deep file type validation
• Size limits
• Secure storage

Rate Limiting

Protection against abuse:

• All public endpoints are rate-limited
• Sensitive operations have stricter limits
• Automatic blocking of excessive requests

Input Validation

All user input is:

• Validated on client and server
• Sanitized before storage
• Protected against injection attacks

Your Security Responsibilities

Account Security

• Protect the email account, or the Microsoft or Google account, you sign in with
• Turn on multi-factor sign-in for that account
• Don’t share credentials
• Log out on shared devices

User Management

• Remove access promptly when staff leave
• Use principle of least privilege
• Review user access regularly
• Monitor for unusual activity

Data Handling

• Don’t download unnecessary data
• Secure your local devices
• Report suspicious activity
• Follow your organization’s policies

Security Features by Plan

Reporting Security Issues

If you discover a security vulnerability:

1. Email security@sarportal.com
2. Provide detailed description
3. Don’t publicly disclose
4. We’ll respond promptly

Security & Compliance

Hosted on Microsoft Azure, which holds ISO 27001 and SOC 2 certifications. SAR Portal itself is not ISO 27001 or SOC 2 certified; we hold Cyber Essentials and Cyber Essentials Plus (independently audited). Data is encrypted in transit and at rest with Microsoft-managed keys, and application secrets are kept in Azure Key Vault. Every uploaded file is scanned for malware by Microsoft Defender for Storage. The database has continuous backup with 7-day point-in-time restore.

• Built to help you comply with GDPR
• Built with privacy by design