MFA is enabled for all the users to increase the security levels. The primary objective of multi-factor authentication is to reduce the risk of account takeovers and provide additional security for users and their accounts. Since over 80% of cyber breaches happen due to weak or stolen passwords, MFA can provide added layers of security necessary to protect users and their data.

Obeikan's system is hosted in AWS on a container basis.

 Both role based and user based access controls are available for the Obeikan product suite.

What is your recovery point objective in case of critical failure? (e.g., your DB is deleted)

Will your product be a system that your enterprise customer critically depends on? (i.e., a failure would cost them a ton of money)

Are you also using other third-party services to manage or support your customers?

Are you hosted only on one of the major cloud providers or do you have any on-premise systems?

Obeikan maintains a rigorously documented Incident Response Plan that serves as our predefined procedure for handling potential security incidents. This plan is systematically reviewed, tested, and approved by appropriate stakeholders on an annual basis to ensure readiness and effectiveness in responding to security incidents.

Obeikan engages in thorough annual risk assessments that span multiple critical teams, including engineering, security, privacy, legal, and AI safety, among others. These assessments are designed to identify and address significant vulnerabilities within our operational environment. The findings from these assessments are carefully reviewed and considered by an executive risk committee, which integrates these insights into broader organizational strategic planning.

Obeikan is committed to maintaining robust asset management practices that span both virtual and physical assets. Our asset management policy is designed to systematically identify and catalog organizational assets while defining appropriate protection responsibilities and is updated annually.

Obeikan is committed to maintaining a high level of security and privacy awareness among its personnel through comprehensive annual training programs. This training covers critical topics secure communication, data classification, phishing, physical security, social engineering, data privacy, third-party/application security, laptop standard, protect data, and acceptable use.

To ensure the integrity and security of our operations, all new Obeikan employees undergo a thorough background check and sign a non-disclosure agreement upon joining. These measures are part of our annually reviewed HR security policy, which mandates compliance with company policies and procedures designed to safeguard organizational assets and information.

Obeikan performs regular vendor risk assessment to evaluate the security practices of our key vendors and partners. This assessment was conducted by our internal security team in collaboration with external cybersecurity experts to provide a comprehensive evaluation.

 We recently engaged a leading cybersecurity firm to conduct a thorough penetration test of our systems. The objective of this test was to assess our infrastructure, applications, and security protocols against current and emerging threats.

Obeikan has a high level network diagram

Obeikan conducts a comprehensive risk assessment regularly to evaluate the current security posture of our systems, applications, and processes. This assessment was conducted by our internal security team in collaboration with external cybersecurity experts to ensure a thorough and unbiased evaluation.

Obeikan internal systems access is restricted by stringent access control measures monitored and updated according to industry best practices on a regular basis. Access to internal systems is adherent to the principles of least privilege and separation of duties, subject to regular review by administrators, documented with clear rationales for provisioning and changes, and revoked according to strict termination policies.

We have a strong internal password policy that includes a requirement for MFA . Passwords are required to meet industry-leading complexity requirements and are stored in a company managed password manager.

Personnel perform security and privacy awareness training on an annual basis. Topics covered include: Passwords, Mobile devices, Social Engineering, Physical security, Phishing and compliance with SOC 2

In the event of a data breach involving customer data, notifications will be sent in accordance with the terms of the MSA.

Obeikan infrastructure is hosted by AWS

At Obeikan, the production, staging, and development environments are maintained as distinct entities to safeguard operational integrity and data confidentiality. In these separate environments, customer data is strictly prohibited from use in non-production settings, thus ensuring that developmental and testing activities do not compromise data security.

We have a formal Business Continuity and Disaster Recovery plan, which is exercised, reviewed and approved annually. Obeikan also conducts regular testing of critical services, backup systems and operational infrastructure to ensure business continuity requirements are met. Our risk assessment program and business impact analysis are scoped across the organization, reflecting our commitment to preparedness across business areas.

All customer data is encrypted at-rest. Obeikan is committed to following encryption best practices per industry guidelines and continually reviews the rigor of current encryption standards.

All customer data is encrypted in-transit. Obeikan is committed to following encryption best practices per industry guidelines and continually reviews the rigor of current encryption standards.

Obeikan captures backups on a regular basis to ensure internal and customer data is protected from loss according to our Business Continuity and Disaster Recovery procedures.

All employee endpoints are protected with an advanced EDR solution. Endpoint security signals are monitored regularly for anomalous activity.

Obeikan Security Defense and Intelligence Team actively monitors the environment for known attacker tactics, techniques, and procedures (TTPs), as well as known malicious binaries and other suspicious activities. These regular activities are complemented by periodic reviews and investigations into anomalous activities to discover unknown threats occurring on a regular cadence.

Cyber insurance is an integral part of security risk reduction at Obeikan. We maintain an insurance policy with cyber coverage in the event of a security incident that results in financial damages.

Obeikan is committed to upholding robust and compliant data processing practices.

Safeguarding customer privacy is a core commitment of Obeikan service Additional information on our privacy practices

Our network activity is logged with specialized detection logic in place to identify potential security threats such as unauthorized access or anomalous behavior. These systems are critical for the early detection of attacks, allowing us to identify attackers and other anomalous behavior and generate alerts for further investigation.

A network diagram is a visual representation of a network's structure and components.