Encryption
TLS 1.3 in transit. AES-256-GCM at rest. Envelope encryption for tenant data-keys with per-workspace key rotation.
Security
Built for a regulated, high-stakes industry.
Your drillhole data, reserves models and signed reports are among the most commercially sensitive documents your company owns. We treat them that way.
Authentication
MFA required on every admin session. SSO / SAML / OIDC support for Team & Enterprise plans. Passkey (WebAuthn) roll-out in Q2 2026.
Authorisation
Role-based access control with least-privilege defaults. Fine-grained project, module and dataset-level permissions.
Auditability
Immutable, tamper-evident audit log covering every user action — accessible in the UI and exportable via API.
Infrastructure
Hardened Kubernetes clusters. Least-privilege IAM. Continuous vulnerability scanning. Blue/green deploys with signed container images.
Data residency
Region-locked deployments in India, EU, Australia and US. Enterprise on-prem and air-gapped deployments fully supported.
Compliance posture
SOC 2 Type II
Audit in progress · 2026
ISO 27001
Controls followed · certification in progress
GDPR
DPA available on request
India DPDPA
Fully compliant · DPO named
APP (Australia)
Fully compliant
HIPAA / PCI
Not applicable to mining data
Our security operating model
Secure SDLC
Every commit passes automated SAST, SCA and secret-scanning. Peer review is mandatory. Nothing lands in production without a signed CI attestation.
Quarterly penetration tests
Independent third-party pentests every quarter. Findings triaged inside 48 hours and remediated inside 30 days for High/Critical.
Vulnerability disclosure
Coordinated disclosure at security@sresources.co. Responsible-disclosure researchers get a public credit + bounty on eligible reports.
Incident response
24×7 on-call rota for P0 incidents on Enterprise plans. Public post-mortems within 5 business days of any customer-facing incident.
Need a security review or DPA?
Enterprise buyers get direct access to our security team, our latest pentest summary, DPA / SLA templates and a fully populated CAIQ.