A security approach, not claimed certifications

Security by design

Security is part of every system's design from the first decision, not a layer added at the end. Every architectural choice is evaluated against: who has access, what they can do with it, and how that is recorded.

Least privilege

Every user and every technical integration is granted the narrowest scope of permission needed to perform its role — nothing broader. This applies equally to human users and to registered application permissions.

Access control and segregation of duties

Role-based access control (RBAC) and Maker/Checker separation between creating and approving an action are foundational in every system we build, not an optional add-on.

Auditability

Every action with real effect — create, modify, approve, reject, exception — is logged well enough to later answer: who did what, when, and under which rule or authority.

Secrets and encryption

• Secrets (access keys, credentials) are read from the server environment at execution time only, and never appear in client-side code, the source repository, or logs.
• Encryption is applied where technically appropriate to the context (in transit and at rest), according to each project's requirements and environment.

Secure integration and input validation

Every input from a visitor or an external system is validated and sanitized before processing — length, format, and content — to prevent injection, header manipulation, or unexpected input.

Logging discipline and environment separation

Operational logs do not carry full request content or sensitive personal data. Development, staging, and production environments are kept separate and do not share real data or secrets.

Vulnerability management approach

Software dependencies are reviewed periodically, and baseline security headers are enabled in production, with a deliberate, tested rollout path from report-only to enforced policies where applicable.

Human approvals

Sensitive decisions — restricting an account, approving an exception, changing a cap — pass through human approval under the institution's approved policy, not silent automated execution.

Reporting a security concern

To report a vulnerability or a security concern related to the website or our solutions, please contact Mohanad.Alhassan@pas.qa. Please do not include sensitive or confidential data in that report.