Deployment
Many of our customers cannot send operational data outside their own network, so our products are built to be installed on customer infrastructure. We agree the deployment model for each project in the contract, and we document what runs where.
When a product is installed on your servers, the data it processes stays on your infrastructure. It leaves your network only if you connect the product to another system.
Shared responsibility
For an on-premise installation, security is shared between your team and ours.
| Ashkar is responsible for | The customer is responsible for |
|---|---|
| The security of our application code and its default configuration | Servers, operating systems, networks and firewalls |
| Fixing vulnerabilities in our products and delivering updates | Applying updates to the installation |
| Installation guidance, including recommended secure settings | Backups, physical security and certificates for encrypted connections |
| Support access only when you grant it, for as long as it is needed | User accounts, role assignments and the directory they come from |
For any part of a service that we host or operate for you, the contract sets out our responsibilities.
Identity and access
- Role-based access control in every product, scoped to the organization, site, region or department the product works with.
- There is no public sign-up: accounts are created by administrators.
- Ganjoor connects to Active Directory or LDAP, so accounts follow your existing joiner, mover and leaver process.
- Ganjoor applies confidentiality levels (normal, internal, confidential) to content, so sensitive material reaches only the people cleared for it.
Audit and change history
Our products keep a record of the events that matter for accountability:
- In Ganjoor: who viewed, downloaded, edited, reviewed and approved content, in a full audit log.
- In Modaf: every change to assessment questions, coefficients, department weights, positions and people, with its history.
- In Modaf, each completed assessment stores a snapshot of the model used, so later changes never rewrite past results.
AI features
Ganjoor Assistant answers questions using a language model that runs on the customer’s own infrastructure, with no dependency on external cloud services. It answers only from knowledge that has been reviewed and approved in Ganjoor, cites the source of each answer, and respects each user’s access rights.
We do not use one customer’s data to train or improve models used by another customer.
Controls by product
| Product | Security controls |
|---|---|
| Ganjoor | On-premise installation and language model; role-based access with confidentiality levels; Active Directory and LDAP integration; full audit log; watermarking of documents; prevention of bulk downloads. |
| Modaf | Role-based access across five organizational levels; rankings shown only within each user’s scope; full change history; assessment snapshots. |
| Najva | Accounts created only by administrators; configurable usage limits for each account. |
Customer data
- We process customer data only to deliver, support and improve the service for that customer, as set out in the contract.
- Our demonstrations and sales materials use demo data, not customer data.
- When a contract ends, we return or delete any customer data we hold, as the contract specifies.
How we handle personal data is described in our Privacy policy.
Our team
Only the people working on a customer’s project can access that customer’s systems, only when the customer grants access, and only for as long as the work requires. Everyone on our team works under confidentiality obligations.
Security updates
When we fix a security vulnerability in one of our products, we tell the customers who use the affected version and provide the update. For on-premise installations, the customer applies the update, and we help where needed.
Incident response
If we become aware of a security incident affecting customer data that we hold or process, we will:
- notify the affected customer without undue delay;
- explain what happened, what data is affected and what we are doing about it;
- work with the customer’s team until the incident is resolved;
- notify the competent authority where the law requires it, including within 72 hours under Oman’s Personal Data Protection Law.
Report a vulnerability
We welcome reports from security researchers and customers. If you believe you have found a vulnerability in one of our products or in this website, please email us.
Email: [email protected], with “Security report” in the subject.
Please include: the affected product or page, steps to reproduce the issue, its likely impact, and how we can contact you.
We acknowledge reports within 2 working days and keep you updated until the issue is resolved.
Please do give us reasonable time to fix the issue before disclosing it, use only test accounts or data you own, and stop as soon as you have confirmed the issue.
Please don’t access, change or delete other people’s data, run denial-of-service tests, use social engineering or phishing, or test physical security.
If you act in good faith and follow these guidelines, we will not pursue legal action against you for your research, and we will credit you if you wish.