Built for regulated
environments.
ICAN MENA clients include banks, ministries, and family holdings. Security and data handling are not a feature list here — they are the condition of doing business. This is exactly how it works.
How it works
Data residency
Primary data region is Frankfurt, Germany (eu-central-1). All customer project, task, and attachment data is stored in that region by default. We do not replicate to regions outside the EU without explicit agreement.
Tenant isolation
Multi-tenant by organisation. Every customer-facing table carries an org_id column protected by PostgreSQL Row-Level Security. API routes apply org filters on top of RLS as defence in depth. No shared buckets, no cross-tenant joins.
Authentication
Email and password, OAuth (Google), and magic-link invites backed by Supabase Auth. Passwords are salted and hashed with bcrypt, never stored in plaintext. Admin routes verify session and role on every request — no implicit trust.
Secrets & scheduled jobs
Service-role keys, cron secrets, and email provider keys are injected at runtime through Vercel environment variables. Secret comparisons use constant-time equality to prevent timing-based enumeration. Diagnostic endpoints return booleans only — never values.
Audit logging
Role changes, invites, status transitions, approvals, and destructive admin actions are written to an activity log with actor, target, timestamp, and metadata. Retained for the life of the organisation.
Infrastructure
Application hosted on Vercel (SOC 2 Type II, ISO 27001). Database and auth on Supabase (also SOC 2 Type II). TLS 1.2 or higher on every public endpoint. No long-lived containers we operate ourselves.
Privacy & data handling
We never train on customer data. We never sell data to third parties. Transactional email carries per-type unsubscribe. External stakeholders receive only the digest they were explicitly added to, and can be removed at any time.
Need a deeper review?
If you are a compliance or IT team and need specific documentation, a data processing addendum, or architectural diagrams, we will walk through them with you. Ask for whatever your review requires.
Cleared by your reviewers? Start there.
Trial a single app on real work before anything is signed. No card, no commitment.