Security & trust
Security you can prove, not just promise.
Your ledger, your people's data and your e-invoicing keys deserve more than a login screen. UPAX is built so that isolation, authority and evidence are properties of the platform — not settings someone can forget.
How UPAX protects your data
Controls built into the platform.
Fail-closed tenant isolation
Every company-owned record carries its tenant. Queries without a tenant context return nothing, cross-tenant writes are blocked, and a leak test suite runs on every build.
Role-based authority
Permissions are scoped to each company. Approval limits follow roles and value bands, and segregation of duties is enforced in the workflow engine.
Enterprise identity
OpenID Connect SSO with Entra ID, Google Workspace or Okta, SCIM 2.0 provisioning, passkeys, and deactivation that ends every session immediately.
Hash-chained audit trail
An append-only, per-company audit log, each event chained to the last by SHA-256 with field-level differences. One click proves nothing was altered.
Encrypted sensitive data
Employee IBANs, IDs and passport numbers, integration secrets and service credentials are encrypted and kept out of audit diffs and API responses.
Keys never leave the vault
E-invoicing signing keys live in a key store: the application asks for signatures and never reads a private key. Hardware or cloud KMS stores plug in per region.
In-region deployment cells
Designed for separate UAE and Saudi environments, so data can stay in the country it belongs to.
Resilient operations
Health checks, request tracing, encrypted and verified backups, and tag-driven deploys with a health gate and automatic rollback.
Quality on every change
Hundreds of automated tests — unit, architecture, cross-tenant leak and e-invoicing — run on two database engines before any release.
Evidence, on demand
When the auditor asks, the answer is already there.
Who changed what, when and why is recorded on every record — and continuous control tests check segregation of duties, dormant privileged accounts, audit-chain integrity and late period close against live data every day.
- Risk
- Control
- Test
- Evidence
- KRI
How is each company's data separated?
Every tenant-owned record carries its tenant, and a fail-closed scope means queries without a tenant context return nothing. A dedicated test suite checks for cross-tenant leaks on every build.
Does UPAX support single sign-on?
Yes. UPAX supports OpenID Connect single sign-on with Microsoft Entra ID, Google Workspace and Okta, SCIM 2.0 user provisioning and passkeys.
Where is data hosted?
UPAX is designed for in-region deployment cells, with separate UAE and Saudi environments for data residency requirements.
Bring your security questions.
Our team will walk your IT and risk leads through isolation, identity, audit and hosting in detail.