Security

Controls in the hosted service

• Account authentication with scrypt password hashing, WebAuthn passkeys, OAuth/OIDC and session revocation.
• Personal API keys and SCIM bearer tokens are hashed at rest, scoped and revocable.
• Organization roles, owner-only administration, member suspension, seat limits and access policy enforcement.
• OIDC SSO uses PKCE, state, nonce and JWKS verification; SAML validates signed assertions against the organization's IdP certificate.
• Verified-domain requirements for SSO, encrypted client secrets and state/nonce/PKCE validation.
• Private blob storage, authorized downloads and seven-day default retention.
• SHA-256 integrity checks on outputs before delivery.
• Rate limits, submission guards, audit events and an operations console.
• Stripe handles card data; Saar does not store card numbers.

What Saar does not claim

• Saar is not encryption, authentication or a security certification.
• HEOSSI does not claim ISO 27001, SOC 2 or equivalent certification for Saar.
• Integrity checks detect corruption; they do not prove who created a file.
• No system is completely secure, and no control is a guarantee against every threat.

Report a vulnerability

Use the Vulnerability Disclosure Policy and email saar-security@heossi.com. The security.txt file is published at /.well-known/security.txt. Do not access, modify or exfiltrate customer data, and do not test availability with denial-of-service traffic.

Security contact

Security and abuse: saar-security@heossi.com. Legal: saar-legal@heossi.com. Company: HEOSSI (PTE.) LTD., Singapore, UEN 202532790K.