Technical and Organisational Measures (TOMs)

Outhentik Technical and Organisational Measures

This document describes the technical and organisational measures implemented by Dahi Alttatbiqat Establishment, trading as Outhentik ("the Processor"), to protect personal data processed on behalf of its customers ("Controllers") in accordance with Article 32 of the EU GDPR and UK GDPR.

This document forms an integral part of the Outhentik Data Processing Agreement (DPA) and is incorporated by reference.

Effective date: Same as the Outhentik DPA in force. Last updated: 10 October 2026 Version: 1.5 Published at: outhentik.app/security

1. Confidentiality

1.1 Access control

Access to systems containing personal data is restricted to the Processor's authorised personnel. At present that is the founder, who is the sole authorised administrator of all production infrastructure. No employees, contractors or third parties have direct access to production data.

Access controls in place include:

• Unique credentials for each production service (Supabase, Vercel, Cloudflare, Speechmatics, Google Cloud, OpenAI, Pinecone, Resend, Paddle, Sentry, UptimeRobot)
• Strong, randomly-generated passwords stored in a password manager
• Multi-factor authentication (MFA) enforced on all production infrastructure accounts
• Multi-factor authentication enforced on the email account used for password recovery and account verification
• Session timeout policies on administrative interfaces

1.2 Authentication of Controller users

The Controller's authorised users authenticate to the Outhentik dashboard via:

• Email and password authentication with secure password hashing (managed by Supabase Auth), or Google sign-in
• Email verification on account creation

Multi-factor authentication is not currently offered to Controller users.

1.3 Confidentiality obligations

The Processor's authorised personnel are subject to confidentiality obligations consistent with Article 28(3)(b) GDPR. Where future employees or contractors are engaged with access to personal data, written confidentiality agreements will be put in place prior to access being granted.

2. Integrity

2.1 Encryption in transit

All personal data is transmitted over encrypted channels using TLS 1.2 or higher:

• HTTPS enforced on all customer-facing interfaces (message pages, dashboard, Wall of Love and embed)
• Encrypted database connections between application and Supabase
• Encrypted API connections to every sub-processor listed in Section 6.2

2.2 Encryption at rest

Personal data is encrypted at rest where supported by sub-processors:

• Database (Supabase, Singapore region): AES-256 encryption at rest, managed by Supabase
• Voice and video storage (Cloudflare R2, Western Europe region): AES-256 encryption at rest, managed by Cloudflare
• Authentication credentials: Stored as bcrypt-hashed values, never as plain text

Voice and video files are served from long, unguessable addresses rather than from signed, expiring links. Anyone who holds a file's address can open it; the address is shown only to the Controller's own users, and to the public only for a video the end-customer allowed and the Controller approved.

2.3 Input validation and integrity checks

The Outhentik application implements:

• Server-side validation of all user inputs
• Database constraints enforcing referential integrity
• Append-only records of every end-customer consent and of every case action (assigning, contacting, resolving, reopening), which no Controller user and no Processor role can edit
• Webhook signature verification for incoming events from Paddle

3. Availability

3.1 Backups

Database backups are performed automatically by Supabase under the Processor's paid plan, with retention sufficient to support recovery from accidental deletion or corruption. Backup data is subject to the same access controls and encryption as live data.

Voice and video storage in Cloudflare R2 benefits from Cloudflare's distributed storage architecture and replication.

3.2 Disaster recovery

In the event of a major service disruption, the Processor will:

• Restore service from the most recent valid backup
• Notify affected Controllers via email if downtime exceeds four (4) hours
• Document the incident, root cause, and remediation steps

The Processor does not offer an uptime commitment unless an Order Form says otherwise.

3.3 Monitoring

Service availability and performance are monitored continuously through:

• UptimeRobot: external uptime monitoring with email alerts
• Sentry: application error tracking with alerting on anomalies

4. Resilience and recoverability

4.1 Incident response

The Processor maintains an informal incident response procedure:

• Detection through Sentry alerts, UptimeRobot alerts, customer reports, or sub-processor notifications
• Assessment of impact, affected systems, and affected Data Subjects
• Containment through isolation of affected components or rollback of recent changes
• Communication with affected Controllers via email, with target notification within four (4) hours of confirmed incident
• Post-incident review documenting cause, impact, and preventative measures

4.2 Personal data breach notification

In the event of a confirmed personal data breach affecting Controllers' data, the Processor will notify affected Controllers without undue delay, and in any event within seventy-two (72) hours of becoming aware of the breach, in accordance with Section 8 of the DPA.

5. Pseudonymisation and data minimisation

5.1 Data minimisation

The Outhentik platform is designed to collect only the personal data necessary for its stated purposes:

• Name, email address, phone number and star rating are all optional for end-customers; a message is accepted without any of them
• A phone number is asked for only when the end-customer asks to be contacted and the Controller accepts WhatsApp
• Nothing is made public except a video the end-customer allowed and the Controller approved
• The topic analysis receives message text and transcripts, never the voice or video file
• Internal logs do not store personal data beyond what is necessary for security and audit purposes

5.2 Pseudonymisation

Where feasible, internal identifiers (UUIDs, location slugs) are used in place of direct personal identifiers in logs and analytics.

6. Sub-processor management

6.1 Selection criteria

Sub-processors are selected based on:

• Demonstrable security posture (SOC 2 Type II reports, ISO 27001, or equivalent for major sub-processors)
• GDPR compliance and ability to enter into Article 28-compliant data processing agreements
• Track record and reputation in the SaaS infrastructure market

6.2 Current sub-processors

The Processor engages these sub-processors. This is the same list as Section 2.1 of the DPA and outhentik.app/sub-processors, generated from one source.

Independently verified security certifications held by these providers, as published by them:

• Supabase: SOC 2 Type II, HIPAA-eligible
• Cloudflare: SOC 2 Type II, ISO 27001, ISO 27018, PCI DSS
• Vercel: SOC 2 Type II, ISO 27001
• Speechmatics: ISO/IEC 27001:2022, SOC 2 Type II
• Google (Places API, Gemini API, Google Analytics): Google Cloud's ISO 27001, ISO 27017, ISO 27018, SOC 2 Type II and SOC 3 programme
• OpenAI: SOC 2 Type II
• Pinecone: SOC 2 Type II, ISO 27001
• Resend: SOC 2 compliance programme
• Paddle: PCI DSS Level 1, SOC 2 Type II
• Sentry: SOC 2 Type II, ISO 27001
• UptimeRobot: operational security controls; no access to Controller personal data beyond status check responses

6.3 Ongoing oversight

The Processor reviews sub-processor security postures periodically and on the occasion of any reported security incident affecting a sub-processor.

7. Data deletion and retention

7.1 Standard retention

Voice and video files are kept for as long as the Controller keeps its Outhentik account, so the Controller can play them back when handling a case or reviewing a recurring issue. Messages, their transcripts and their consent records are kept for the same period. The Controller can delete any message at any time, and its voice or video file is deleted from object storage with it.

7.2 Account deletion

Cancelling a subscription does not lock or delete anything: the account and its data are kept. When a Controller requests deletion of its account:

• Day 0: The account is locked and all sessions are signed out. A deletion_requested_at timestamp is recorded.
• Days 1 to 30: Grace period, during which signing in again cancels the deletion.
• Day 30: A scheduled job, which runs every hour, permanently purges all data, including:
  • Voice and video files in Cloudflare R2 storage
  • Database records (cascaded across all related tables)
  • Authentication user records
  • Associated metadata and logs (other than minimal records required for legal compliance)
• Day 30 to Day 90: Backup retention period, during which deleted data leaves backup systems.

7.3 Data subject erasure requests

Where a Controller instructs the Processor to delete specific Data Subject records, the Processor will execute deletion within thirty (30) days from production systems and within ninety (90) days from backups.

7.4 Retention required by law

Billing data processed by Paddle.com Market Ltd may be retained beyond the standard deletion period in accordance with applicable tax, accounting, and anti-money-laundering laws. Such retention is governed by Paddle's own data retention policies.

8. Physical security

The Processor does not operate or maintain physical infrastructure where Controller personal data is stored. All processing infrastructure is hosted by the sub-processors in Section 6.2, in commercial data centres in these regions:

• Singapore: Supabase Inc.
• European Union: Cloudflare, Inc. (R2 storage); Speechmatics Ltd; Functional Software, Inc. (Sentry)
• United States: Vercel Inc.; Google LLC (Places API); OpenAI, L.L.C.; Pinecone Systems, Inc.; Resend Inc.
• Global: Google LLC (Gemini API)
• United Kingdom: Paddle.com Market Ltd
• Switzerland: Seven Assets Ltd (UptimeRobot)

Physical security of these data centres is the responsibility of the respective sub-processor and is covered by their independently-audited security certifications (see Section 6.2).

The Processor's authorised personnel access systems from the Processor's working environment in Saudi Arabia, secured by:

• Locked physical premises
• Password and biometric protection on all devices accessing production systems
• Full-disk encryption on devices used for production access
• No printed or written records of personal data, credentials, or access tokens
• Multi-factor authentication on all infrastructure accounts and the email account used for password recovery

9. Organisational measures

9.1 Roles and responsibilities

The Processor is currently operated by its founder, who serves as the data protection contact, security lead and operations lead. The data protection contact is reached at [email protected]. As the Processor grows, formal role separation will be implemented and reflected in updated versions of this document.

9.2 Awareness and training

The Processor maintains current knowledge of GDPR, UK GDPR, and applicable data protection law through ongoing self-education, monitoring of supervisory authority guidance, and consultation with legal counsel where appropriate.

9.3 Documentation

The Processor maintains:

• This Technical and Organisational Measures document
• The Outhentik Data Processing Agreement
• A current list of sub-processors
• Incident response logs (created in the event of a security incident)
• Records of Data Subject requests received and responses given

9.4 Vendor and supplier management

All sub-processors are engaged under terms requiring compliance with applicable data protection law. Where a sub-processor materially changes its security posture, certifications, or data processing practices, the Processor reassesses the engagement.

10. Continuous improvement

The Processor commits to:

• Reviewing these measures periodically and following any significant change to the platform, sub-processor stack, or applicable law
• Implementing additional measures where reasonable and appropriate to the level of risk
• Pursuing formal certifications (such as SOC 2 Type II) when commercial scale and customer demand make such investment appropriate
• Engaging with independent security testing (penetration testing, vulnerability assessments) as the platform grows

11. Limitations and honesty statements

The Processor acknowledges the following limitations relevant to its current scale:

• The Processor does not currently hold formal third-party security certifications (SOC 2, ISO 27001) in its own name. The Processor relies on the certified security postures of its sub-processors as set out in Section 6.2.
• The Processor does not currently conduct independent penetration testing or third-party security audits. Such measures will be implemented as commercial scale and customer demand justify.
• The Processor does not currently carry cyber liability insurance. This is under review and will be procured at appropriate commercial scale.
• The Processor does not offer a service level agreement or an uptime commitment unless an Order Form says otherwise.
• Multi-factor authentication is not currently offered to Controller users.

These limitations are stated transparently. The Processor does not represent or imply security postures it does not hold.

12. Updates to this document

This document is reviewed periodically and updated to reflect changes in:

• Applicable data protection law
• The Processor's sub-processor stack
• Operational practices and security measures
• Customer security requirements

The current version is always available at outhentik.app/security. Material updates affecting Controllers' data are notified to Controllers via email or in-app notification.

Document version 1.5. Effective from the date stated above. Published at outhentik.app/security as a companion to the Outhentik DPA at outhentik.app/dpa.