Security and privacy at Madar
Your data and your project's source code are in our care. This page describes what we actually do to protect them, not general promises.
Protecting accounts and systems
- All our systems run over an encrypted connection (HTTPS).
- Two-factor sign-in is mandatory for every administration or finance account in our systems.
- Each employee sees only what their work needs: separate roles for administration, finance and projects.
- Repeated failed sign-ins are blocked automatically.
Your data in the client portal
- Each client signs in through a private link and password, and sees only their own projects and documents.
- Sensitive data, such as ID numbers in contracts, is stored encrypted.
- Financial attachments are stored outside the public website and open only from inside the system.
Backups
- A full backup every day, encrypted with AES‑256.
- Every month we actually restore the latest backup into a temporary database to prove it works, not just that it exists.
Tamper-evident logs
Every sensitive action in our systems is written to a log linked by a chain of digital fingerprints, so no line can be changed or deleted without it showing. The log is checked automatically every day, and we are alerted at once if anything was altered.
Confidentiality in our contracts
- We sign a non-disclosure agreement on request before seeing the details of your project.
- Ownership of the source code passes to you as your contract states.
- We never develop or test with your real customers' data; we test with dummy data.
Secure development of your projects
- We protect your systems against common attacks: SQL injection, cross-site scripting and request forgery.
- Permissions are checked on the server for every request, not only hidden in the interface.
- No update goes live before the automated tests pass and the owner approves it, and a backup to roll back to is always kept.
ISO/IEC 27001
We are building Madar's information security management system to the international standard ISO/IEC 27001: documented and approved policies, regular risk assessment, every employee signing the policies, and a yearly management review.
We are implementing the standard now, on the way to certification by an accredited certification body, and will announce it here once it is granted.
Found a vulnerability?
If you notice a security problem in any of our systems, write to info@madarsoftware.com. We thank everyone who reports in good faith, and we answer every report.
How do we handle your personal data? Read the privacy policy.
Book a consultation or reach us directly