Security & trust
Enterprise security as standard, not an upgrade
Pilgrim data is sacred trust. Every UmrahCore tenant — regardless of size — runs on the same hardened identity, isolation and audit architecture.
Hard tenant isolation
Each Master lives in a sealed tenant. Cross-tenant reads are structurally impossible — not merely hidden by the interface.
Sibling privacy
Resellers can never see other Resellers; Agents can never see other Agents. Bookings, prices and notes stay walled off.
Cascading ceilings
Permissions flow strictly downward. Nobody can grant an account more access than they themselves hold.
Identity routing
Username-based sign-in resolves each account to its tenant automatically — no shared portals to misconfigure.
Append-only audit
Every consequential action is written to an immutable trail, with a dedicated change log for Super Admin activity.
Defence in depth
Brute-force lockout, contested-login handshakes, 2FA and modern password hashing protect every doorway.
Authentication
Every sign-in walks a guarded path
Authentication is a sequence of checks, not a single gate. A username first routes to the correct tenant. Five failed attempts inside ten minutes lock the account. A sign-in while a session is already active triggers a contested-login handshake instead of a silent takeover.
- Two-factor authentication via email one-time codes or authenticator-app TOTP.
- Passwords hashed with Argon2id or bcrypt, with policy-driven 90-day rotation.
- Idle sessions expire after 60 minutes — no forgotten tabs holding live access.
- Suspending an account cascades instantly through everything beneath it in the tree.
Sign-in checkpoint ladder
Data protection
Documents that never touch a public URL
Passports, visas and medical certificates are among the most sensitive documents a travel business holds. In UmrahCore they live in a document vault served exclusively through an authenticated proxy — there is no public link to guess, share or index.
Shared pilgrim identity data and private commercial data are deliberately separated: an agent transferring a pilgrim never exposes another business's pricing or notes.
- Provider-independent object storage (S3 or R2) — your files are never locked to one vendor.
- Visa copies enforced server-side before a booking can advance — not a front-end suggestion.
- Per-Master factory reset gives each tenant genuine ownership of its own data lifecycle.
Audit trail · last events
Account safeguards
Lockout threshold
5
failed attempts / 10 minutes
Idle timeout
60
minutes before session expiry
Password rotation
90
day policy-driven expiry
Audit trail
100%
of consequential actions, append-only
Security questions? Good.
Bring your compliance checklist to a demo — we will walk the isolation, identity and audit model end to end.