Skip to main content
SHIELDRA EGSecure Software Engineering
SHIELDRA EGTrust Center

The Trust Center

The bar is fixed. The file is written.

Encryption, access, audit, and isolation are the house standard in every SHIELDRA engineering engagement in Egypt. They are not a page, a package, or a phase after launch. How each layer is applied is selected in discovery, against the system you actually run, and named in the written scope. This page is that statement. It is not a certificate.

Book a Discovery CallRead the datum

  • The bar

    Fixed

  • Discovery

    Written

  • The record

    Attributable

  • The edge

    Not a certificate

The standard

Four stations on one datum.

Read it as a committee would. The Fixed rail is what the house always holds. The Selected rail is what discovery writes for this system. The gold line is the bar. Work is measured against it. It is not drawn after the demo.

SHIELDRA EG

Trust Center

STD-01

The Datum

Cairo

FixedIn every written engineering scope.

SelectedNamed in discovery for this system.

  1. Fixed

    Data in transit and at rest where the system holds what must be protected. The bar is encryption. It is not an optional add-on after launch.

    L 01Encryption

    Selected

    Which stores, which keys, which exceptions. Named against the constraints of this system, and written into the file.

  2. Fixed

    Least privilege. No implicit trust. Every request is verified. Roles exist so that a person can do only what the mandate allows.

    L 02Access

    Selected

    Which roles, which identity source, which sessions, and who may not act. RBAC is designed for this operation, not copied from a template.

  3. Fixed

    Sensitive actions are attributable to an actor, a time, and an object. A system that cannot answer those questions is not finished.

    L 03Audit

    Selected

    Which events are logged, how long they are kept, who may read the log, and what is handed over. Retention is scoped. It is not implied.

  4. Fixed

    Tenants, roles, and environments are bounded. Customer data is not mixed by default. A shared password is not a boundary.

    L 04Isolation

    Selected

    Shared or dedicated, which environments, which integrations may cross a boundary. Isolation is named for this estate.

The bar is the house standard. The implementation is not a SKU. Extra controls, including monitoring and secrets handling, are selected where they belong and written into the same file.

The Datum is a control plane, not a product catalogue. The homepage rings show the Secure Core as identity. This plate shows the standard a board can hold against the work.

Discovery writes

What is selected is still written.

The bar does not mean every control is identical on every estate. It means the four stations are always in the file. The choices below are made in discovery, against constraints, and they are named before engineering starts.

  1. Item 01

    What is encrypted, and where

    Which data stores, which traffic, which backups. What cannot be encrypted because of a constraint is named as residual risk, not hidden.

  2. Item 02

    Who may act

    Identity source, roles, sessions, and separation of duties. Least privilege is the rule. The role map is this operation's, written down.

  3. Item 03

    What the log must hold

    Which sensitive acts are recorded, retention, and who may read. An audit log that cannot be retrieved after the chair changes is not a log.

  4. Item 04

    What is kept apart

    Tenant, role, and environment boundaries. Shared platforms still isolate. Dedicated platforms still name the edge.

  5. Item 05

    What sits beside the bar

    Monitoring, secrets handling, deployment hardening, and integrations. Selected where they belong. Never sold as a scanner subscription.

  6. Item 06

    Whether Law 151 sits in this file

    Where PDPL applies, engineering readiness is scoped. It is not assumed from this page, and it is not a certificate we issue.

Law 151

PDPL readiness is engineering. It is not a certificate we issue.

Egypt's Personal Data Protection Law is named here because organizations ask. The honest answer is narrower than a banner. Readiness is designed into the work where it applies, then written. We do not stamp a certificate at the end of a call.

What it means

Alignment in the engineering.

Where the law applies, we design the system so personal data handling can be explained: access, retention, isolation, and the record. That work is scoped. It is confirmed in discovery. It lives in the agreement, not on a homepage badge.

What it does not mean

Not a certificate. Not an opinion.

We do not issue a PDPL certificate. We do not sell ISO or SOC banners. We are not the regulator. We are not an auditor signing an opinion. If a licensed assessment is required, it stays with the party the law names.

Security reduces risk. It does not eliminate it. PDPL on this site always means engineering readiness, not certification.

One bar. Two ways it sits.

New build and existing systems are not the same engagement.

The datum does not change. The work does. A platform designed on the Secure Core carries the bar from the first module. A live system is hardened against the same bar, ranked by exposure, inside the constraints of what already runs.

  1. Path 01

    New build

    Internal platforms, operational systems, procurement files, and custom modules. Encryption, access, audit, and isolation are designed with the first requirement. They are not bolted on after the demo. The Secure Core is the floor the module stands on.

    Open internal platforms

  2. Path 02

    Existing systems

    Hardening is engineering on production. Review, ranked findings, then controls the estate can actually take. Not a rebuild. Not a scanner subscription. Residual risk is written down and left with the team.

    Open hardening

How a board reads

A committee can ask four questions of any sensitive act.

Government and private sector boards fail in the gap between the screen and the file. The record standard is the same: who, what, when, which object. If the system cannot answer, the work is not finished. This is how the datum is read, not a substitute for the government file.

  1. Q 01

    Who acted?

    An attributable actor. Not a shared password. Not an anonymous admin. Access control must be able to name the person or the service.

  2. Q 02

    What was done?

    The sensitive act: approve, award, override, export, change a role. The log names the action. A screenshot is not the action.

  3. Q 03

    When?

    A time the committee can trust. Not a slide from a demo. The clock on the record is part of the engineering.

  4. Q 04

    Which object?

    The tender, the record, the file, or the person. Named. Retrievable after the chair changes. Isolation keeps the object from dissolving into someone else's data.

On a government path, those four answers are the record the entity must be able to defend. Open Government for how SHIELDRA sits with that mandate. The datum is the engineering that makes the answers possible.

The edges

What this page will not claim.

The Trust Center is useful only if it is honest. If we do not hold a licence, a mandate, or a certificate, the file says so.

  1. Cl. 01

    Not a PDPL certificate, an ISO banner, or a SOC report we issue. We do not sell certifications. Where a licensed assessment is required, it stays with the party the law names.

  2. Cl. 02

    Not a security guarantee. Security reduces risk. It does not eliminate it. Residual risk is scoped and written. It is not hidden behind a slogan.

  3. Cl. 03

    Not a ministry, an authority, or a substitute for the entity that holds the public duty. We engineer. The mandate stays with the entity.

  4. Cl. 04

    Not an audit opinion, a penetration-test certificate as a product, or a sign-off that the estate is safe. Verification is scoped work. It is not a stamp.

  5. Cl. 05

    Not licensed legal representation, investment advice, or tax advice. Advisory under the house seal is counsel. Licensed acts stay licensed.

  6. Cl. 06

    Named awards and current Egyptian government contracts are not listed here as a banner. Prior UK team history is professional background. It is not a present mandate.

Where the bar is applied

This page is the standard. The paths are how it sits in the work.

Do not read the Trust Center as a catalogue of products. Read it as the datum. Then open the engagement that actually applies it.

In writing

The questions other pages already imply.

  1. 01

    Are you PDPL certified?

    No. PDPL here is engineering readiness under Law 151, written into scope where it applies. It is not a certificate we issue. We do not sell ISO or SOC banners.

  2. 02

    Do you guarantee the system cannot fail?

    No. Security reduces risk. It does not eliminate it. Residual risk is named in the file. A guarantee that a system cannot fail is not a claim we will print.

  3. 03

    Is security bolted on after launch?

    No. For work SHIELDRA builds, encryption, access, audit, and isolation are designed with the first requirement. They are the house standard, not a package added after the demo.

  4. 04

    What if the system already exists?

    That is hardening, not a new build. The same bar is applied to production: review, ranked findings, then controls the estate can take. Constraints and residual risk are written. It is not a rebuild by another name.

  5. 05

    How does a committee read the record?

    Who acted, what was done, when, and which object. If the system cannot answer, the work is not finished. On a government path, that is the record the entity must be able to defend.

  6. 06

    If the bar is fixed, what is selected in discovery?

    How each layer is applied: stores, roles, events, isolation, extra controls, and whether Law 151 sits in this file. The stations are always present. The implementation is named against this system and written into the agreement. Nothing is committed until it is written.

SHIELDRA EGTrust Center

The first conversation

Bring the system. We will say what belongs in the file.

What you run, what you will build, and what a board must be able to read. We will say whether the work is a new build, hardening, or a written note, and what the datum requires before anyone codes.

Book a Discovery CallRead the datum

We reply within one business day. No public pricing. Nothing is committed until it is written.