01
Access and MFA
Only the rights each role needs.
- Home
- Security
Security and compliance, built in.
Designed in from the first diagram, not bolted on before launch.
Our approach
Enterprise grade from day one.
Security is part of the product, with controls you can inspect.
- Least-privilege access everywhere
- Reviewed at design, build and launch
- No claims we cannot back up
Controls
The controls behind every project.
02
Encryption
In transit and at rest.
03
Documented APIs
Auth, limits and versions spelled out.
04
Audit trails
Who changed what, and when.
05
Secure development
Reviews and scanning on every change.
06
Data residency
Hosting regions agreed per project.
Lifecycle
Security at every step of delivery.
Design
Threat modelling before build starts.
Build
Peer review and automated scanning.
Test
Security review before every launch.
Run
Monitoring, patching and tested backups.
Compliance
Built to support PDPA and GDPR compliance.
- Consent records on every channel
- Access and deletion on request
- Clear data processing terms
Responsible disclosure
Email security ↗
Found a vulnerability?
Email security@outbuy.io with steps to reproduce. Please give us time to fix it before sharing.
Is Outbuy certified to a security standard?
We do not claim certifications we do not hold. We follow recognised good practice and will walk your security team through our controls and answer your questionnaire in detail.
Where is our data stored?
It depends on your project. We agree hosting regions and data residency with you during Discover, based on your markets and regulatory needs.
Can our security team review your work?
Yes. We share architecture diagrams, API documentation and test and security reports, and we welcome your own reviews and penetration tests.
How do I report a vulnerability?
Email security@outbuy.io with the details. We acknowledge reports promptly and keep you informed while we fix the issue.
Ready to sell more online?
Free 30-minute call. Clear quote. Then we get it done.