Security & compliance

Access policy, personal-data protection under the PDPL, and alignment with the National Cybersecurity Authority controls and ISO 27001 — in one place an auditor can read.

Compliance posture

0100

out of 100 — assessed today

Data in the Kingdom100%No data transferred outside the Kingdom

Single sign-on (SSO)

Each entity with its own identity provider

Microsoft Entra ID
Horizon Holding · 13 users
Connected
Google Workspace
Horizon Tech · 2 users
Connected
SAML 2.0 — ADFS
Horizon Logistics · 4 users
Connected

Block password sign-in for SSO usersOne break-glass account stays for the system admin.

Two-factor authentication

Required for everyoneAsked on every new sign-in and every 12 hours.Required for admins and approvers onlyOptional for viewers.OptionalNot recommended — fails ECC control 2-2.

Allowed methods

NafathAuthenticator appSecurity key (FIDO2)SMSWeakest — fallback only

Extra check before signing or approving above SAR 1M

Password policy

For break-glass and external accounts

Minimum length

Upper and lower case, digits and symbols

Reject breached passwords

Block reuse of the last 5 passwords

Lock the account after 5 failed attempts

Sessions

End the session after idle

Maximum session length 12 hours

One web session per user

Allow sign-in from inside the Kingdom onlyTravellers ask the system admin for a temporary exception.

Allowed networks for system admins

10.20.0.0/1610.30.0.0/16188.48.21.0/24