Trust &
Security

Mutual confidentiality obligations apply to every engagement under our Terms and Conditions. Each party holds the other party’s non-public information in strict confidence and uses it only for the purposes of the engagement.

Confidentiality obligations extend to all personnel and contractors who handle client or personal information. Where SA Media engages subcontractors, SA Media remains responsible for the delivery of services under the applicable Service Agreement.

Production services run on enterprise-grade cloud infrastructure, Vercel and Supabase, with built-in redundancy, automatic scaling, and geographic distribution.

• Encryption in transit with TLS 1.2 or higher, and encryption at rest using AES-256 or equivalent where supported by the hosting platform.
• Application databases backed up daily with point-in-time recovery; backups retained for a minimum of 30 days.
• Full payment card details are processed by our payment processor and are never stored by SA Media.
• Personal information is retained only as long as needed for the purposes it was collected for and our legal obligations, as set out in our Privacy Policy.

Our website and client portal are built with layered, defence-in-depth controls:

• Strict Content Security Policy, HTTP Strict Transport Security with preload, and framing disabled (X-Frame-Options: DENY).
• A restrictive Permissions Policy that disables camera, microphone, geolocation, payment, and device-sensor access.
• Input validation and length limits on every API route and server action, and HTML sanitisation on published content.
• File uploads restricted by type and extension, with path traversal protection.
• Rate limiting on public forms.
• Client portal access scoped to each client organisation, with ownership checks before any change is made.

Our Privacy Policy addresses the requirements of PIPEDA (Canada), the GDPR (EU and UK), the CCPA (California), the UAE PDPL, and Singapore’s PDPA.

Analytics cookies are only used with consent: visitors can decline through our cookie banner, which opts them out of Google Analytics.

Incidents are classified into three severity levels with committed response and resolution targets, set out in full in our Service Level Agreement. A Severity 1 incident, a complete outage or a data breach affecting production systems, receives a response within 1 hour, a target resolution within 4 hours, and status updates every 30 minutes until resolved.

In the event of a personal data breach likely to put individuals’ rights and freedoms at risk, SA Media notifies the relevant supervisory authority within 72 hours where required by law, and notifies affected individuals without undue delay where the risk is high.

Scheduled maintenance is announced at least 48 hours in advance. Emergency security patches may be applied with shorter notice to protect the integrity of systems.

We use a small set of established providers to operate our services:

• Vercel: website and application hosting.
• Supabase: database, authentication, and file storage for the client portal.
• Google: business email, Google Analytics, and Google Tag Manager.
• Calendly: meeting scheduling.
• Advertising and social platforms (including Meta, Google, TikTok, and LinkedIn) are operated on a client’s behalf, under that platform’s own terms.

If you believe you have found a security vulnerability in samedia.io or the SA Media client portal, please email info@samedia.io with the subject line “Security” and enough detail for us to reproduce it.

Please give us reasonable time to investigate and fix the issue before sharing it publicly, and do not access, change, or delete data that does not belong to you, or degrade the service for others. We will acknowledge your report and keep you updated on our progress.

Enterprise clients can request documentation for vendor onboarding and security review. Email info@samedia.io and we will route your request to the right person.