Products
Security
SSL by default, least-privilege access, hardening, and a defined incident-response process across every environment.
Overview
Security here is structural, not a checklist bolted on afterwards. Every tenant runs in its own Docker container, so one site can't reach into another's filesystem or processes. Traffic is HTTPS end to end, TLS certificates come from Let's Encrypt and renew automatically, and the hosts themselves are hardened Linux with fail2ban banning IPs that misbehave.
Your data lives inside Saudi Arabia — hosting, DNS, and backups all run on our Riyadh infrastructure. We keep GitHub scopes least-privilege and don't request more access than a build needs. We make no certification claims; these are the concrete controls we actually run.
How it works
- 1
Isolation by default
Each customer app is a separate Docker container. Tenants don't share a runtime, filesystem, or process space.
- 2
Encryption in transit
HTTPS is enforced with automatic HTTP-to-HTTPS redirects; certificates are issued and renewed by certbot.
- 3
Abuse gets blocked
fail2ban watches for abusive patterns and bans offending IPs at the host firewall level.
- 4
Least-privilege access
Our GitHub integration requests only the scopes needed to build your project, and secrets are injected at deploy time.
Under the hood
Per-tenant Docker container isolation between all customer applications.
HTTPS enforced everywhere with Let's Encrypt certificates auto-renewed by certbot.
fail2ban bans abusive IPs; hosts run a hardened Linux configuration.
Least-privilege GitHub scopes — the integration reads only what the build requires.
Saudi data residency: hosting, our own BIND9 DNS, and any backups we hold all stay in Riyadh.
Key facts
- Tenant isolation
- Docker container per site
- Encryption
- HTTPS enforced, Let's Encrypt TLS
- Intrusion defence
- fail2ban + hardened Linux
- Data residency
- Riyadh, Saudi Arabia
- Access model
- Least-privilege GitHub scopes
What's included
Container isolation between tenants
HTTPS enforced with auto-renewing Let's Encrypt TLS
fail2ban IP banning against abusive traffic
Hardened Linux hosts
Least-privilege GitHub access scopes
Secrets injected at deploy time, not committed to the repo
Saudi data residency across hosting, DNS, and backups
Daily backups on managed cPanel/WordPress hosting as a recovery safeguard (PaaS/Docker rolling out)
Frequently asked questions
Are you ISO or SOC 2 certified?
We make no certification claims on this page. What we can describe precisely is the controls we run: container isolation, enforced HTTPS, fail2ban, hardened Linux, least-privilege GitHub access, and Saudi data residency (your data stays inside the Kingdom). For compliance documentation, contact us at info@mahsumaah.sa.
How is my site isolated from other customers?
Every customer application runs in its own Docker container with a separate filesystem and process space. One tenant cannot read or reach another's container.
Is my data kept in Saudi Arabia?
Yes. Hosting on Huawei Cloud ECS in Riyadh, our own BIND9 DNS, and any backups we hold all stay within the Kingdom.
What GitHub access do you take?
Only least-privilege scopes needed to build the specific repository you deploy. We don't request broad organisation-wide access.
Start on Mahsumah Cloud
Start in minutes, or let our team migrate your current platform for you.