Security & Data Protection
Our Commitment to Protecting Your Data and Privacy
Last Updated: October 12, 2025
Overview
At Sharayeh, security isn't an afterthought—it's a fundamental part of everything we do. We understand that you're trusting us with your sensitive data, and we take that responsibility seriously. Our security infrastructure is designed from the ground up with data protection in mind.
🔐1. Data Encryption
1.1 Encryption in Transit
All data transmitted between your device and our servers is encrypted using:
- TLS 1.3 - The latest Transport Layer Security standard
- HTTPS - Mandatory for all communications
- Perfect Forward Secrecy - Ensures past data cannot be decrypted even if keys are compromised
- SSL certificates from trusted authorities with automatic renewal
1.2 Encryption at Rest
Your data is encrypted when stored using:
- AES-256 - Military-grade encryption
- Separate encryption keys for each user
- Secure key management with regular rotation
- Industry-standard compliant storage (AWS KMS, Google Cloud KMS)
🏗️2. Infrastructure Security
2.1 Data Centers
We use tier-1 cloud service providers with:
- SOC 2 Type II certification
- ISO 27001 compliance
- 24/7 physical security and access controls
- Redundant facilities and multiple geographic locations
- Fire suppression and environmental monitoring systems
2.2 Network Security
- Network isolation and segmentation
- Firewalls and intrusion detection systems (IDS/IPS)
- Enterprise-grade DDoS protection
- Virtual Private Networks (VPNs) for administrative access
- Regular network security scanning and auditing
🔑3. Access Controls
3.1 Authentication
- Multi-Factor Authentication (MFA) support for all accounts
- Strong password requirements (minimum 8 characters, upper/lower case, numbers, symbols)
- Password hashing using bcrypt/Argon2
- Secure session management with automatic expiration
- OAuth 2.0 authentication for social logins
3.2 Authorization
- Role-Based Access Control (RBAC)
- Principle of least privilege - users get minimum required access
- Data isolation between user accounts
- Regular review and revocation of unused access permissions
- Logging of all access attempts and changes
📁4. Data Handling & Deletion
4.1 File Lifecycle
⏱️ Uploaded files are automatically deleted within 24 hours of processing
- Secure deletion with data overwriting
- No storage of processed files after delivery
- Temporary content time-limited in cache
- Immediate deletion upon user request
4.2 Backup & Recovery
- Encrypted daily backups of account data
- Geo-redundant storage
- Regular recovery testing
- 30-day backup retention (account data only, not uploaded files)
👁️5. Monitoring & Detection
- 24/7 security monitoring of all systems
- Real-time anomaly detection
- Automated alerts for suspicious activity
- Comprehensive logging of all system events
- Regular security log review
- Automated vulnerability scanning
- Quarterly penetration testing by external experts
🚨6. Incident Response
We have a comprehensive incident response plan that includes:
- Dedicated response team available 24/7
- Incident documentation procedures
- Containment and mitigation protocols
- Root cause analysis
- User notification in case of data breach (as required by law)
- Post-incident improvements
⚠️ Report Security Vulnerabilities: If you discover a security vulnerability, please report it immediately to security@sharayeh.com. We appreciate responsible disclosure and work quickly to address all reported issues.
👨💼7. Employee Security
- Comprehensive background checks for all employees
- Non-Disclosure Agreements (NDAs) and confidentiality
- Mandatory security training at hiring and annually
- Need-to-know basis access only
- Immediate access revocation upon termination
- Quarterly access permission reviews
✅8. Compliance & Certifications
We comply with industry standards and regulations:
We conduct regular audits to ensure ongoing compliance with all applicable standards and regulations.
🤝9. Third-Party Security
We carefully select and monitor all third-party vendors:
- Comprehensive security assessment before integration
- Regular review of vendor security practices
- Data Processing Agreements (DPAs)
- Minimum necessary data access
- Only certified and compliant providers (AWS, Google Cloud, Stripe, Clerk)
💡10. Best Practices for Users
While we handle the technical side, you can help keep your account secure by:
- Using a strong, unique password
- Enabling Multi-Factor Authentication (MFA)
- Never sharing your account credentials with anyone
- Logging out from shared or public devices
- Reviewing your account activity regularly
- Reporting any suspicious activity immediately
- Keeping your software and browsers updated
- Being cautious of phishing attempts
Contact Security Team
Have security questions or concerns? We're here to help:
Related Pages: