Effective Security Management
Tarabut’s Information Security Management System (ISMS) ensures a structured approach to managing information security, and is fully aligned with ISO/IEC 27001:2022 and regulatory standards from CBB and SAMA. Our ISMS addresses business risks and establishes tailored security controls. We are committed to maintaining best practices through regular audits, and every employee plays a key role in adhering to these standards. Tarabut’s Information Security Team oversees implementation and continuous improvement across all operations.
Our Commitment to Information Security
Our Commitment to Information Security
At Tarabut, we take a process-driven approach to safeguarding information through our Information Security Management System (ISMS). This includes:
Aligned Security Objectives
We prioritize and set clear goals to protect all organisation and client data.
Risk Management
We implement comprehensive controls that address business risks effectively.
Continuous Monitoring
Regular assessments ensure our ISMS adapts to evolving security challenges.
Ongoing Improvements
We foster continual enhancement through objective metrics and regular evaluations.
Cross-Company Communication
We ensure compliance with all statutory and regulatory requirements across out business.
Resource Dedication
We allocate the necessary resources to monitor, sustain and support our ISMS.
Measures we take
Measures we take
Through the implementation of robust policies and procedures, we manage information systems and assets securely, meeting legal, regulatory, and contractual obligations. Below are the key components of our ISMS that ensure the highest levels of data protection and security.
Tarabut’s encryption standards are derived from industry best practices and the requirements issued by NCA’s National Cryptographic standards, in the Kingdom of Saudi Arabia. Information handled by the organisation is encrypted in transit and at rest. Any information provided by clients which has personally identifiable information (PII) or sensitive information, is additionally encrypted. Access to encryption keys is strictly controlled and maintained through a full audit trail.
We use encryption protocols such as TLS 1.2 to ensure data security at rest and in transit. All interactions through our REST APIs are secured via HTTPS, and we require all connections to our API servers to use HTTPS to protect information from our servers to the end-user. We encourage Providers to use the same methods to ensure that information is encrypted all the way to you as the end-user.
We conduct automated, continuous vulnerability scanning across our products and systems. Vulnerabilities are classified based on risk (e.g., Critical, High, Medium, Low) using industry standards such as the CVSSv3 score. All vulnerabilities are remediated in accordance with our established Vulnerability Management Policies. If you are a security researcher, please refer to our Vulnerability Disclosure Programme.
Tarabut performs internal and external penetration testing. The organization complies with regulatory and security best practices in penetration testing, network and public facing application penetration tests are conducted by an independent certified third-party every six months. We also perform penetration tests for any significant updates to existing products or before the release of a new product.
We log all API calls and interactions with our products and services to ensure transparency and accountability. Logs are retained according to regulatory requirements and industry best practices to ensure compliance.
Information Security Pack
Information Security Pack
Tarabut is dedicated to maintaining top-tier information security, offering transparency through our Information Security Pack (InfoSec Pack). This resource provides insights into our measures, controls, and safeguards, helping partners conduct their due diligence.
Request the InfoSec Pack
Request the InfoSec Pack
For more information, or to request our InfoSec Pack, please contact infosecpackrequest@tarabut.com. An NDA may be required for access.
Key Security Measures
Comprehensive ISMS
Our Information Security Management System (ISMS) ensures the confidentiality, integrity and availability of information assets, aligning with industry standards and regulatory requirements.
Advanced Monitoring
Continuous risk assessments, vulnerability management, and incident response planning keep our systems secure. We implement 24/7 monitoring of threats and vulnerabilities
integrated with automated ticketing systems.
Employee Training
Ongoing security awareness programs empower staff to identify and address potential threats.
Penetration Testing
Bi-annual assessments by third-party experts to identify potential vulnerabilities.
Data Protection
Compliance with UK GDPR, Bahrain's PDPL, UAE'S PDPL, and Saudi Arabia's PDPL ensures that all customer data is managed with care.
Certifications
ISO27001:2022 Certified: Annual audits to maintain high standards.
