Security is a core product concept in Basirah, not an add-on. The controls below are built into the platform.
Tenant isolation
Every organization is a separate tenant. Survey definitions, responses, users, and files are scoped to their tenant and are not accessible across tenants. Data access is filtered by tenant on every request.
Authentication
- Single sign-on via OpenID Connect — Google or your own identity provider.
- Email and password sign-in with server-side verification and brute-force lockout.
- Optional multi-factor authentication (TOTP) with recovery codes and trusted devices.
- Server-bound sessions that can be revoked, with enforced expiry.
Authorization
Role-based access control governs what each user can see and do (administrator, author, reviewer, viewer, and platform operator). Administrative access to a tenant's content is explicit and audited.
Encryption in transit
All traffic to the platform is served over HTTPS/TLS. Public certificates are issued and renewed automatically. Internal service-to-service traffic runs on a private network that is not exposed to the internet.
Auditability
Security-relevant actions across authoring, distribution, and results are recorded in an audit trail with actor, action, and timestamp, so administrators can review who did what and when.
Data handling & hosting
Survey data and generated exports are hosted on dedicated infrastructure in a Frankfurt, Germany (EU) data centre (Hostinger). Uploaded files and exports are served through signed, time-limited links. Retention and sub-processors are described in the Privacy notice.
Certifications
Basirah does not currently hold formal third-party security certifications such as ISO 27001 or SOC 2. We are happy to complete a security questionnaire and provide a data-processing agreement (DPA) on request.
Responsible disclosure
If you believe you have found a security vulnerability, please contact us at info@basirahtech.com. We appreciate coordinated disclosure and will work with you to validate and resolve reports.