Security

Taqyid (operated by DIGIQUEST CONSULTING) is a compliance-critical platform: it holds the halal certification records that our customers present to JAKIM auditors. Protecting that data — and keeping it isolated between organisations — is a core requirement, not an afterthought. This page summarises the technical and organisational measures we apply.

Encryption

• In transit: all traffic is served over HTTPS (TLS), with HTTP Strict Transport Security (HSTS) enforced.
• At rest: the primary database (Neon PostgreSQL) and file storage (Supabase) encrypt stored data at rest using industry-standard AES-256.

Tenant isolation

Taqyid is strictly multi-tenant. Every record is scoped to its owning organisation, and that scoping is enforced server-side in the data-access layer — not merely hidden in the user interface. A user authenticated for one organisation cannot read or modify another organisation's data.

Access control

• Granular RBAC: access is governed by a role-based permission model applied server-side on every request, following the principle of least privilege.
• Separation of duties: sensitive workflows enforce segregation — for example, the person who creates an audit, non-conformance report or certificate cannot be the one who validates or closes it.
• Halal governance roles: designation of the Halal Executive (Eksekutif Halal) and related privileges follow the JAKIM MHMS 2020 governance model.

Audit trail

Security- and compliance-relevant actions are written to an audit log. Existing entries cannot be modified: a database-level trigger rejects any update. Audit records are kept for as long as the customer organisation's account is open and, unless the organisation instructs us otherwise, for three (3) years after the account is closed, in line with JAKIM record-keeping requirements (see our Terms of Service, 12.3); they are not currently deleted automatically. For existing customers, this retention period applies from 5 November 2026, the date on which the updated Terms of Service take effect for them.

Infrastructure & monitoring

• Hosting: the application runs on Vercel; application data is stored on Neon (PostgreSQL) and Supabase (authentication and file storage), with production data hosted in the Asia-Pacific region.
• Environment isolation: production, staging and development run on isolated databases; preview and staging deployments are protected behind authentication and are not publicly accessible.
• Monitoring: errors and performance are monitored with Sentry, and abusive traffic is mitigated with rate limiting.

Secure development

• Automated security gates run in our continuous-integration pipeline on every change: secret scanning, dependency vulnerability auditing and static application security testing (SAST).
• Third-party build actions are pinned to fixed versions, and access tokens follow least-privilege scoping.
• The codebase is written in strictly typed TypeScript, and changes are peer-reviewed before release.

Standards & compliance

Taqyid is purpose-built for the JAKIM Malaysian Halal Management System (MHMS 2020) and MPPHM 2020 (Pindaan 2026). Our data-protection practices are aligned with the EU GDPR and Malaysia's Personal Data Protection Act 2010 (PDPA), and our security program is informed by the SOC 2 Trust Service Criteria and OWASP application-security guidance.

For details on how we handle personal data, see our Privacy Policy, our Data Processing Agreement and our list of sub-processors.

Reporting a vulnerability

We welcome coordinated disclosure of security issues. If you believe you have found a vulnerability, please email security@taqyid.cloud. Our machine-readable security contact is published, per RFC 9116, at /.well-known/security.txt. Please give us a reasonable opportunity to investigate and remediate before any public disclosure, and do not access, modify or delete data that does not belong to you.