Encryption in transit: TLS 1.2+ on all connections
Encryption at rest: AES-256-GCM for credentials, PostgreSQL with RLS
Authentication: HMAC-SHA256 tokens, JWT with revocation, Microsoft JWKS validation
Access control: PostgreSQL Row-Level Security on every multi-tenant table (33+ tables), per-request tenant isolation
Audit trail: Append-only audit ledger with SHA-256 hash chain, daily integrity verification cron, up to 7-year retention (configurable per org; 365-day default)
Monitoring: Synthetic uptime probes every minute against each service (web, dashboard, API) feeding the public status page at status.simiriki.com; Sentry for error tracking; circuit breakers on external API calls (Microsoft Graph, Stripe, Anthropic)
Audit Scoring Methodology
Our audit evaluates your Microsoft 365 + Azure estate across 197 detection rules (151 via Microsoft Graph + 46 via Azure Resource Manager) in 8 categories:
Infrastructure: License utilization, connector health
Operational Maturity: Process automation, approval workflows
Each rule is scored as CRITICAL, HIGH, MEDIUM, or LOW severity. Your maturity score (0-100) is calculated relative to your industry and company size — we don't penalize manual processes that are industry-standard.
At least 25% of recommendations address non-digital dimensions (process improvement, compliance, training). Reports include a methodology note explaining how your score was calculated.
Sub-processors
Your data is processed by simiriki and the following third-party services:
Microsoft Azure (USA) — Primary infrastructure (Container Apps, Postgres, Storage, Key Vault, Front Door), East US 2 region
Microsoft 365 / Graph (USA) — Customer M365 OAuth (read-only) during scans + Graph SendMail for transactional email
M365 scan data: Processed in real-time, not stored after report generation
Diagnostic responses: 180 days, then auto-deleted
Client projects: 1 year (non-payment) or 5 years (payment, per SAT requirements)
Audit trail: 7 years (compliance requirement)
Newsletter subscribers: Until unsubscribe
Incident Response
In case of a security incident:
72-hour notification to affected clients (per LFPDPPP Art. 16)
Automated breach detection via 197 server-side detection rules
Incident logged in tamper-evident audit ledger
Post-incident report within 5 business days
Your Rights
Under LFPDPPP, you have the right to Access, Rectify, Cancel, or Object (ARCO) to the processing of your data. Contact us at jjdlr@simiriki.com with subject "ARCO Rights." We respond within 20 business days.
Zero paper — all audit reports, contracts, and communications are digital
Remote-first — no physical offices, no commute emissions
Every process we automate for our clients eliminates repetitive manual tasks, reduces energy consumption from desktop workstations, and replaces paper-based compliance workflows with cloud-native alternatives.
Security Researchers
We welcome responsible disclosure of security vulnerabilities. See our Responsible Disclosure Policy for details. We acknowledge reports within 72 hours and provide safe harbor for good-faith researchers.