SaaS security solutions
Providing the business value as Software-as-a-Service means putting extra stress on scalability, maintainability, and operational management. Customers' demands, GDPR-related risks, and constant data breaches signal that just checking a few checkboxes in AWS configuration would barely be enough to do the job.
We have built a data-protection layer for SaaS providers. Our solutions help secure the data stored and exchanged in SaaS' zone of responsibility, through application level encryption, selective or end-to-end encryption and allow achieving compliance with ISO/IEC 27001, PCI DSS standards.
SaaS security challenges
Lots of responsibility for SaaS owner
Besides protecting users' data, SaaS companies care about shielding their API against malicious users, overloading and misusing.
Growing vs securing
Integrating security controls into an actively growing product is hard due to the need to balance out the system's performance, scalability, and maintainability.
Compliance is a thing
Numerous data privacy regulations (GDPR, CCPA, LGPD, SOC2) make the SaaS provider who handles sensitive customer data responsible for it, not a cloud provider.
Large attack surface
Enterprise customers require specific data security policies to protect their data. Such policies extend way beyond "we've turned on all the AWS security features".
Modern SaaS security solutions
SaaS encryption
Systems that use selective or end-to-end encryption combined with pseudonymisation or anonymisation of data.
Scalability and security
Security controls should scale via processes and replicas horizontally, and provide SIEM-compatible log streams of their behaviour.
Zero Trust architecture
A sufficient separation of users' PII, meta-data and keys for better protection without jeopardising the integrity of the company's infrastructure.
Tools and services we offer
Themis
A cross-platform cryptographic library for mobile, web, and server platforms, which solves 90% of typical data protection use cases that are common for most apps. Themis helps to integrate application level encryption fast and easy.
Read more
Acra
Offers a transparent application level encryption which is easy-to-integrate to already existing infrastructures. Use AcraServer to encrypt database fields “on the fly”, use Acra’s Requests Firewall and Anomalies Detection to protect against suspicious queries.
Read more
Anti-fraud systems
API protection, remote device attestation and anti-malware systems that use a mix of signals and rules to detect suspicious and malicious users.
Specialized security controls
Verifiable audit logs, anonymous trackable IDs, data pseudonymisation, data firewalls, intrusion detection systems – our software has a modular structure, and we ship single modules too.
Scalability and performance
Our solutions are well-aligned with a cloud deployment process, Docker- and Kubernetes-friendly, compatible with IAMs, KMSs and SIEMs.
SSDLC
We assist your team in setting up and improving the SSDLC process for app development. We help prioritise security features, find appropriate automation tools, and always sync with the latest security guidelines and regulations.
Auditing and reviewing
We perform security audits and design reviews of existing implementations, how your apps protect sensitive data in storage and in transit, perform authentication, protect API, attest devices, and so on.
Have a question? Get a human to answer it!
How we make a difference
Security & observability
Store and transmit only the encrypted data, gather logs, metrics, and monitoring signals to get a transparent view of the system's behaviour.
Pragmatic security
We help you achieve more while paying less – our solutions attack risks at the very core, instead of patching up the holes.
Security & scalability
We're no strangers to SaaS business, some of us have operated large-scale SaaS infrastructures, so we know their nature and context. Our solutions are built to scale with your business, not to constrain it.
Our mission is simple.
We help you focus on serving your customers better, while relieving your team from security engineering pains and making your users confident that their data is safe with you.
Contact us
There are many ways we can help: with our products, bespoke solutions, and engineering services. Leave your contact information to connect with our team:
Relevant blogposts
Shared responsibility model in cloud security: mind the gap
Security responsibility of cloud providers: where it ends, what are the gaps, and what steps your team should make to improve cloud security strategy.
Acra 0.90.0: application level encryption and searchable encryption for any SQL and NoSQL databases
Acra Community Edition 0.90.0 – database security suite for SQL and NoSQL databases, which comes with application level encryption, searchable encryption, and encryption-as-a-service API available for any developer.
Defense in depth security strategy based on data encryption
Defence in depth approach to building secure apps explained with the help of Acra encryption suite.