Security Policy

01 Our Commitment

At Riyadh Designer, the security of our systems and our clients' data is not optional — it is fundamental. We build websites, manage client accounts, and store project files for businesses across Saudi Arabia and internationally. Every one of those relationships depends on trust, and trust depends on security.

This Security Policy outlines how we protect our digital infrastructure, how we handle data shared by clients, and how we welcome cooperation from ethical security researchers who want to help make the web safer for everyone.

02 Security Practices

We apply industry-standard security measures across all our systems and client projects:

• HTTPS Everywhere: All websites we build use SSL/TLS certificates with HSTS enabled. No exceptions.
• Secure Hosting: Our infrastructure is hosted on reputable providers with 99.9% uptime SLAs, DDoS protection, and automated backups.
• Strong Authentication: Two-factor authentication (2FA) is enforced on all internal accounts. Client admin panels require strong passwords.
• Encrypted Storage: Sensitive client files and credentials are stored encrypted at rest and in transit.
• Regular Updates: CMS platforms, plugins, libraries, and server software are updated promptly to patch known vulnerabilities.
• Least Privilege Access: Team members only have access to the systems and data they need to perform their role.
• Security Headers: We implement Content Security Policy (CSP), X-Frame-Options, and other headers on delivered websites.
• Input Validation: All user-facing forms are validated and sanitized to prevent injection attacks.

03 Client Data Protection

We treat client data with the highest level of care. Specifically:

• Data Minimization: We only collect the minimum information needed to deliver a project.
• Secure Sharing: Client files and credentials are shared via encrypted channels, never through unencrypted email.
• Isolation: Each client project is stored in an isolated directory or workspace — no cross-contamination between clients.
• Controlled Access: Only the specific team members working on a project can access its files.
• Deletion on Request: After project handoff, clients can request full data deletion within 30 days.
• No Third-Party Sharing: We never sell, rent, or share client data with third parties for marketing purposes.

For full details on how we handle personal data, read our Privacy Policy.

04 Incident Response

If a security incident occurs, we follow a clear, documented process:

• Detection: Continuous monitoring of our systems and client sites for anomalies.
• Containment: Immediate action to isolate affected systems and stop the spread of the incident.
• Assessment: Determine the scope and impact — what data, if any, was affected.
• Notification: If client data is affected, we notify the impacted client and relevant Saudi authorities within 72 hours, as required by the PDPL.
• Remediation: Fix the root cause and patch the vulnerability.
• Post-Mortem: Internal review to prevent recurrence and improve our security posture.

05 Responsible Disclosure

We welcome and encourage security researchers to help us identify vulnerabilities in our website and systems. If you believe you have found a security issue, please report it to us responsibly before disclosing it publicly.

How to report:

• 📧 Email: security@riyadhdesigner.com
• 📧 Alternate: info@riyadhdesigner.com
• 📄 Machine-readable file: /.well-known/security.txt

Include in your report:

• A clear description of the vulnerability and its impact
• Steps to reproduce the issue (PoC code or screenshots help)
• The URL(s) and parameter(s) affected
• Your name / handle for credit (if you want recognition)
• Any suggested remediation (optional)

Our commitment to you:

• We will acknowledge your report within 48 hours.
• We will provide an initial assessment within 5 business days.
• We will keep you updated on our progress until the issue is resolved.
• We will credit you publicly (with your permission) once the fix is deployed.

06 In-Scope & Out-of-Scope

In-Scope (please report these):

• Vulnerabilities on www.riyadhdesigner.com and its subdomains
• Authentication or authorization flaws
• Cross-Site Scripting (XSS), SQL Injection, SSRF, CSRF
• Sensitive data exposure (leaked credentials, API keys, personal data)
• Server-side vulnerabilities affecting our production systems
• Business logic flaws that could impact client security

Out-of-Scope (please do not report these):

• Denial of Service (DoS/DDoS) attacks — never attempt these
• Social engineering of our team or clients
• Physical attacks on our offices or infrastructure
• Automated vulnerability scanner output without proof of exploitability
• Issues in third-party services we use (Google, Cloudflare, etc.) — report to them directly
• Missing security headers that don't lead to an exploitable vulnerability
• Self-XSS, clickjacking on non-sensitive pages, or "best practice" suggestions
• Spam, outdated software versions without proof of exploit

07 Rules of Engagement

To be eligible for a safe harbor, security researchers must follow these rules:

• ✅ Do: Test only against accounts and data you own or have written permission to test.
• ✅ Do: Report vulnerabilities promptly and privately.
• ✅ Do: Use the minimum testing necessary to prove the issue.
• ✅ Do: Stop testing immediately if you encounter sensitive data — report it and delete any copies.
• ❌ Don't: Access, modify, or exfiltrate real client data.
• ❌ Don't: Degrade service or disrupt our operations.
• ❌ Don't: Publicly disclose the vulnerability before we've had time to fix it (we suggest 90 days from report, or until a fix is deployed — whichever comes first).
• ❌ Don't: Demand payment in exchange for silence (extortion is a crime under Saudi law).

08 Recognition

We currently do not operate a paid bug bounty program. However, we are happy to:

• Credit you publicly in our Security Hall of Thanks (with your permission)
• Provide a written letter of appreciation for your portfolio or LinkedIn
• Add you to a public thank-you list on this page
• Consider discretionary rewards for critical vulnerabilities — at our sole discretion

If you would like to be recognized, please include your name/handle in your report.

09 Legal Safe Harbor

Riyadh Designer commits to the following safe harbor for security researchers acting in good faith:

• We will not pursue civil or criminal legal action against researchers who follow this policy.
• We will not report you to authorities for activities conducted within the scope of this policy.
• We will work with you to understand and resolve the vulnerability.
• If a third party brings action against you for your responsible disclosure, we will publicly state that your actions complied with this policy.

Safe harbor applies only if you have complied with all rules in Section 7 (Rules of Engagement). Violations void this protection.

10 Compliance

Our security practices align with:

• 🇸🇦 Saudi Arabia's Personal Data Protection Law (PDPL) — the Kingdom's primary data protection regulation
• 🇸🇦 National Cybersecurity Authority (NCA) guidelines for Saudi businesses
• 🌍 GDPR-aligned principles for any European clients or users
• 🌍 ISO 27001-aligned processes for information security management
• 🌐 OWASP Top 10 mitigation for web applications we build

For enterprise clients with specific compliance requirements (SOC 2, HIPAA, etc.), contact us to discuss how we can support your needs.

11 Contact Security Team

For any security-related inquiry — vulnerability reports, security questionnaires, or enterprise compliance requests:

Response commitment: We acknowledge all security reports within 48 hours, including weekends for critical issues.