Security and Compliance
The controls run inside the system, and the evidence is ready for the auditor
Three classification levels govern who sees a letter and who it can be routed to, the database itself refuses to edit or delete the audit log, and a security center shows the state as it is now. A compliance center says of every control: applied, partial or gap.
- Clearance is checked on opening and on routing, on web and mobile
- A policy chosen at installation: the administrator manages and does not read
- Designed to support ISO/IEC 27001, NCA ECC-2:2024 and NIST CSF 2.0; not a certification
Classification and clearance
A confidential letter does not reach anyone not entitled to see it
Every letter has a classification, and every staff member has a clearance: the highest of their account, their unit and their roles. The check runs on the server, not in the interface.
- Normal
- Confidential
- Top secret
- Head of institutionClearance: top secretOpens it and can receive it
- DirectorClearance: confidentialOpens it and can receive it
- Section staff memberClearance: normalCannot receive it or open its text
Routing to a lower clearance is refused on the server with a clear message, and the check runs again when the letter is picked up.
- On routing and on pickupRouting or forwarding to someone cleared below the letter's classification is refused, and the check runs again on pickup.
- Web and mobile alikeMobile goes through the same access check. The institution can also set the highest level whose text opens on the phone.
- A memo stays between its partiesAn internal memo is seen only by its parties, and is outside the unit head's oversight.
- Access logEvery access to a letter above "normal" is recorded: who opened or downloaded it, when, and from which address.
The administrator manages and does not read
The system administrator manages accounts; a letter's text is not their business
- A policy set at installationWhen the institution chooses this policy, the administrator stops at the letter's edge like any staff member in their position: they see the envelope and the numbers, not the text. Its switch sits in the server settings, not on a screen, so the administrator cannot turn it off for themselves.
- Break-glass when neededTo read one specific letter, the administrator writes a reason and confirms their identity; that letter alone then opens for reading for 15, 30 or 60 minutes.
- The letter's people are toldThe letter's author, its current holder and their unit head are notified with the administrator's name, the reason and the end time, without the subject or the text.
- Logged twiceOpening and closing are recorded in the audit log and the access log, and appear in the security center.
- System administratorAsked to read one specific letter and wrote the reasonWaitingDone
- Identity checkTwo-step verification code before openingWaitingDone
- A grant for one letterRead only · 30 minutesWaitingDone
- The letter's peopleNotified with the administrator's name and the reasonWaitingDone
The grant does not open linked letters, the case file or replies, and the administrator can close it early.
Log and sign-in
What happens is recorded, and whoever signs in proves who they are
A log that cannot be edited or deleted
The database itself refuses to edit or delete the audit log, the letter action log and the access log. 82 kinds of event are recorded in it.
Two-step verification
A code from an authenticator app at sign-in and on mobile, with ten recovery codes. The institution can require it of privileged accounts within 7 days.
Confirmation before sensitive actions
Break-glass, releasing a quarantined file, closing an incident and granting security roles all ask for the code again.
Limited sessions
A session ends after 30 idle minutes or 8 hours, and "remember me" lasts 12 hours. An account locks for 15 minutes after 8 failed attempts.
Stronger passwords
At least 12 characters, common Arabic and English passwords refused, stored with Argon2. Local accounts can reset their own with a link valid for 30 minutes.
A tight connection
Session cookies with the __Host- prefix, one-year HSTS, and a strict content security policy with no inline script. TLS to the database and Redis is a deployment option.
Security Center
The state right now first, then what needs your attention
The security center reads directly from the audit log and the system settings. Security operations and search oversight are switched on by a setting at installation.
- The state in one lineCalm, warning or risk, with the numbers for the last 24 hours: successful and failed sign-ins, locked accounts, and mobile app signals.
- Every control states its conditionProtection controls show "working" or "needs setting up", with the missing setting.
- Incident registerA number for every incident, four severity levels, and stages that never go backwards. Closing needs a post-incident review, and two people for high and critical incidents.
- Search oversightSearch terms are stored masked. Revealing one needs a written reason and lasts 30 minutes, and the overseer sees every reveal.
- Access reviewEvery 90 days, unit heads review their staff's permissions, and whatever is revoked is actually removed.
File inspector and quarantine
Every file is inspected before it arrives, and anything suspicious is quarantined
The inspector is part of the system and runs on every path a file is uploaded through. It inspects the structure of the file; it is not an antivirus.
- 1
Structure check
Executables whatever their extension, double extensions, macros in Office files, active content in PDF, and archive bombs.
- 2
ClamAV if configured
An optional second layer. Without it, the control shows as "partial" in the compliance center, not "applied".
- 3
Suspicious files held
A suspicious file reaches no one, and is kept in quarantine for 365 days by default.
- 4
Four-eyes release
Someone other than the uploader requests the release, and a third person approves it after a re-scan and an identity check. Executables are never released.
Compliance Center
The state of each control against its standard, including what is missing
The compliance center gathers the standards pages in one place. The numbers here are as shown on the pre-demo environment on 2026-09-28; some read the live settings, so they change with what the institution switches on.
- Applied
- Partial
- Gap
- Supported organisational procedure
- The number beside the bar is the count of controls
Security Center
- ISO/IEC 27001:2022Information security: the Annex A controls the Security Center and the core touch11Applied6Partial0Gap4Supported organisational procedure
- NCA ECC-2:2024Essential Cybersecurity Controls: identity and access, logs and monitoring, incidents, and data protection9Applied3Partial1Gap3Supported organisational procedure
- NIST CSF 2.0Cybersecurity Framework: identity and authentication, continuous monitoring, and incident management5Applied3Partial0Gap0Supported organisational procedure
Archive
- ISO 15489-1:2016Records management: concepts and principles7Applied2Partial1Gap0Supported organisational procedure
- ISO 30301:2019Management systems for records: what the archive engine touches3Applied0Partial0Gap1Supported organisational procedure
The whole system
- OWASP ASVS 4.0.3 (L2)Web application security: the Level 2 chapters34Applied7Partial1Gap3Supported organisational procedure
- WCAG 2.2 AAAccessibility: a sample of the core pages21Applied1Partial0Gap0Supported organisational procedure
- ISO/IEC 42001:2023AI management: the Annex A controls Zajil Pen touches5Applied5Partial1Gap1Supported organisational procedure
- NIST AI RMF 1.0AI risk management: governance, measurement and management3Applied5Partial0Gap1Supported organisational procedure
- ISO/IEC 27701:2019Privacy information management: controls for the controller of personal data2Applied4Partial1Gap1Supported organisational procedure
Designed to support these standards; not a certification or an endorsement by the issuing bodies. The two optional modules add their own: ISO 9001 in the Document Center, and CIS Controls and NIST SP 800-50 in Security Awareness.
- Four states"Supported organisational procedure" means the system provides the tool and the institution carries out the procedure, such as a written policy.
- Evidence bundlePDF and Excel export for the auditor, with the evidence of every center the exporter can see.
- For institutions in the GulfThe security center maps 16 controls of NCA ECC-2:2024 to what runs in the system. The binding text is the Authority's Arabic text.
- A written gap analysisAgainst OWASP ASVS Level 2 and WCAG 2.2 AA, stating what is applied, partial and missing as it is.
Frequently asked
About security and compliance
Is Zajil ISO/IEC 27001 certified?
No. Certification is granted to the institution's information security management system, not to software. Zajil is designed to support its controls, and the compliance center says which it supports and which it does not.
Does the system administrator read letters?
That is the institution's decision at installation. Under the policy "the administrator manages and does not read", the administrator sees a letter's text only through break-glass: a written reason, an identity check and a grant for one letter for a limited time, which the letter's people are told about and the log records.
Can the audit log be deleted?
Not from the system: the database refuses to edit or delete it. Separating the database owner's rights from the application remains an operational step at the institution, and the hardening guide explains it.
Do we need ClamAV?
It is not required. The built-in inspector always runs, and ClamAV is a second layer if you configure it. The compliance center shows the difference honestly.
Are events sent to our SIEM?
Yes, if configured: every event is sent over syslog as one JSON line.
Get in touch
Request a briefing with the control matrix
We show you the security center, the compliance center and the gap analysis as they are, including what is missing.