Security at Sarion
Sarion is built to keep your agency's client data safe, isolated, and under your control. Here's how we approach security today, in plain language — and where we're headed.
Your agency's data is scoped to your account
Every client record, project, invoice, and portal in Sarion belongs to a single agency account. Data is scoped and isolated per account — one agency's clients and projects are never visible to another agency using Sarion.
Access within an account is controlled through team member permissions, so you decide who on your team can see and edit what.
Session-based authentication
Sarion uses password-based, session-based authentication. Passwords are hashed — we never store them in plain text. When you log in, Sarion issues a session that keeps you signed in securely as you use the app.
We're actively exploring stronger authentication options, including two-factor authentication, as Sarion grows.
Encrypted in transit
All traffic to and from Sarion is encrypted in transit over HTTPS/TLS, the same standard used across modern web applications. We also work with infrastructure providers who encrypt data at rest as part of their platform.
Modern, monitored hosting
Sarion is hosted on modern cloud infrastructure. We follow standard practices for a hosted SaaS product: regular deployments, monitoring for issues, and keeping dependencies up to date.
Your data isn't for sale
We use the data you put into Sarion only to provide the service to you — we don't sell it, and we don't use it for anything beyond running your agency's workspace. Read the full Privacy Policy for details on what we collect and why.
Regular automated backups
We run regular automated backups of the database as part of normal operations, so your client, project, and invoice data isn't dependent on a single point of failure.
Where we're headed
Sarion has not yet pursued formal compliance certifications such as SOC 2 or ISO 27001. As we grow, we're evaluating these certifications and will update this page as our security program matures.
Found a security issue? Tell us.
If you believe you've found a security vulnerability in Sarion, email us at security@trysarion.com or hello@trysarion.com with as much detail as you can share. We acknowledge every report, work directly with the reporter to understand and address the issue, and follow up once it's resolved. We don't currently run a paid bug bounty program.
How to keep your account secure
A few habits that go a long way, regardless of the platform.
Use a strong, unique password for your Sarion account — don't reuse a password from another site.
Never share your login credentials with teammates. Instead, invite them as team members with their own access.
Log out of Sarion when using a shared or public computer.
Keep the email address on your account up to date, since it's used to verify account access.
Common security questions
Is Sarion SOC 2 or ISO 27001 certified?
Not yet — Sarion hasn't pursued formal compliance certifications. It's something we're evaluating as the company grows.
Does Sarion support SSO or two-factor authentication?
Today, Sarion uses session-based authentication with hashed passwords. We're exploring stronger authentication options, including two-factor authentication and SSO, as the product matures.
Is my agency's data isolated from other agencies?
Yes. Every account is scoped to its own agency — client records, projects, invoices, and portal data are all tied to your account and are not visible to other agencies on Sarion.
How do I report a security issue?
Email us at security@trysarion.com or hello@trysarion.com with details. We acknowledge every report and work directly with the reporter to understand and fix the issue.
Does Sarion sell or share my data?
No. Data you put into Sarion is used only to provide the service to you. See our Privacy Policy for the full details.
Ready to bring your agency into one workspace?
Start free, no credit card required.