Encryption in transit
All data transmitted between your browser and ESSAM servers is encrypted using TLS 1.2 or higher. No process data travels over unencrypted connections.
Your process data is sensitive. We treat it that way.
ESSAM is built for enterprise environments where security, access control, and data governance are non-negotiable. This page outlines how we protect your data and what you can expect from the platform as a responsible enterprise vendor.
Section 01
All data transmitted between your browser and ESSAM servers is encrypted using TLS 1.2 or higher. No process data travels over unencrypted connections.
Process data, SOPs, and generated documents stored on ESSAM servers are encrypted at rest using AES-256 encryption.
Each organisation's data is logically isolated. Your process data, SOPs, and documents are never shared with or accessible by other ESSAM customers.
Section 02
Administrators can assign granular access roles within the platform. Team members only see the processes and documents they are authorised to access.
Enterprise plan customers can integrate ESSAM with your organisation's identity provider via SAML 2.0 SSO. This allows your existing identity and access management (IAM) policies to govern platform access.
All process approvals, document sign-offs, and change events are logged with timestamps and user attribution. Enterprise customers have access to a full audit trail for compliance and governance purposes.
Section 03
ESSAM runs on enterprise-grade cloud infrastructure with built-in redundancy and geographic failover. Our infrastructure provider maintains SOC 2 Type II and ISO 27001 certifications.
We target 99.9% uptime for the ESSAM platform. Enterprise plan customers are covered under a formal Service Level Agreement (SLA). Scheduled maintenance windows are communicated in advance.
Customer data is backed up daily. Backup retention periods and recovery point objectives (RPO) are defined in the Enterprise SLA.
Section 04
ESSAM is currently undergoing formal third-party security assessment in preparation for SOC 2 Type II certification. We anticipate completing this process in the second half of 2026.
ESSAM complies with applicable data protection regulations. Our full Privacy Policy - covering data collection, usage, retention, and your rights as a data subject - is available at apac.essam.ai/privacy.
Read privacy policyESSAM has been deployed inside regulated banking institutions in the Gulf Cooperation Council, including local banks in Kuwait, where data governance and process confidentiality requirements are strictly enforced. We understand the compliance environment that enterprise banking customers operate within.
Enterprise plan customers who require a formal Data Processing Agreement (DPA) or vendor security questionnaire response for their internal procurement processes should contact their ESSAM account manager or reach out via the contact page.
Section 05
ESSAM's staff deployment feature uses the WhatsApp Business API - Meta's enterprise-grade messaging infrastructure - to push approved process guides to your team. This means:
All messages are end-to-end encrypted by WhatsApp's protocol.
ESSAM does not store message content after delivery.
Staff receive read-only process guides - no sensitive back-end data is exposed through the WhatsApp channel.
Enterprise administrators control which processes are deployed and to which staff groups.
Security Contact & CTA
If you are evaluating ESSAM as an enterprise vendor and require additional information for your security or IT review, we are happy to assist. We can provide:
Reach out through our contact page and mention your security review requirements. We will respond within one business day.