Security

Taqyid (operated by DIGIQUEST CONSULTING) is a compliance-critical platform: it holds the halal certification records that our customers present to JAKIM auditors. Protecting that data — and keeping it isolated between organisations — is a core requirement, not an afterthought. This page summarises the technical and organisational measures we apply.

Encryption

• In transit: all traffic is served over HTTPS (TLS), with HTTP Strict Transport Security (HSTS) enforced.
• At rest: the primary database (Neon PostgreSQL) and file storage (Supabase) encrypt stored data at rest using industry-standard AES-256.

Tenant isolation

Taqyid is strictly multi-tenant. Every record is scoped to its owning organisation, and that scoping is enforced server-side in the data-access layer — not merely hidden in the user interface. A user authenticated for one organisation cannot read or modify another organisation's data.

Access control

• Granular RBAC: access is governed by a role-based permission model applied server-side on every request, following the principle of least privilege.
• Separation of duties: sensitive workflows enforce segregation — for example, the person who creates an audit, non-conformity report or certificate cannot be the one who validates or closes it.
• Halal governance roles: designation of the Halal Executive (Eksekutif Halal) and related privileges follow the JAKIM MHMS 2020 governance model.

Immutable audit trail

Security- and compliance-relevant actions are written to an append-only audit log. Existing entries are protected against modification by a database-level trigger that rejects updates, and audit records are retained for a minimum of three (3) years in line with JAKIM record-keeping requirements.

Infrastructure & monitoring

• Hosting: the application runs on Vercel; application data is stored on Neon (PostgreSQL) and Supabase (authentication and file storage), with production data hosted in the Asia-Pacific region.
• Environment isolation: production, staging and development run on isolated databases; preview and staging deployments are protected behind authentication and are not publicly accessible.
• Monitoring: errors and performance are monitored with Sentry, and abusive traffic is mitigated with rate limiting.

Secure development

• Automated security gates run in our continuous-integration pipeline on every change: secret scanning, dependency vulnerability auditing and static application security testing (SAST).
• Third-party build actions are pinned to fixed versions, and access tokens follow least-privilege scoping.
• The codebase is written in strictly typed TypeScript, and changes are peer-reviewed before release.

Standards & compliance

Taqyid is purpose-built for the JAKIM Malaysian Halal Management System (MHMS 2020) and MPPHM (Pindaan 2026). Our data-protection practices are aligned with the EU GDPR and Malaysia's Personal Data Protection Act 2010 (PDPA), and our security program is informed by the SOC 2 Trust Service Criteria and OWASP application-security guidance.

For details on how we handle personal data, see our Privacy Policy, our Data Processing Agreement and our list of sub-processors.

Reporting a vulnerability

We welcome coordinated disclosure of security issues. If you believe you have found a vulnerability, please email security@taqyid.cloud. Our machine-readable security contact is published, per RFC 9116, at /.well-known/security.txt. Please give us a reasonable opportunity to investigate and remediate before any public disclosure, and do not access, modify or delete data that does not belong to you.