Service
Data Security
The stores under billing, CRM, and digital channels are the programme. Access, logging, and backups have to travel with the customer — not sit in a policy that nobody can operate.
Innova Core Technologies treats data security as delivery work, not a slide at the end of a steering pack. From Riyadh we sit with operators, systems integrators, and enterprise IT groups whose customer records already move between campaign platforms, Sugar CRM, MongoDB stores, and revenue and billing systems. A control that only exists on one of those systems is not a control. It is a gap with a name.
The brief we work from is simple. Subscriber files, billing extracts, care notes, and digital profiles are the same person wearing different keys. Microsoft, Oracle, IBM, and MongoDB estates in the Kingdom usually already have tools. The failure is almost never “we have no product.†The failure is that identities, privileges, backups, and audit trails were designed per project, then left behind when the project team demobilised.
What we actually secure
We start with data classes, not with a shopping list of scanners. Who is the customer in this programme? Which fields are identifiers, which are credentials, which are marketing attributes, and which are financial? Campaign audiences, loyalty balances, CRM cases, and rated events often copy the same MSISDN or account id with slightly different spelling. That drift is where access reviews fail and where a subject-access request turns into a war room.
Once the classes are named, we map read and write paths. A prepaid offer that digital can create, campaign can target, care can see, and billing must rate is four integrations and one security story. If privileged users in CRM can export a segment that campaign is not allowed to hold, you do not have least privilege. You have two policies arguing.
We also look at copies you may not list as “productionâ€: lower environments refreshed from live, partner files, and the backup that restores more than operations intended. Data security that ignores restore is theatre. A restore that brings back deleted privileges or an old campaign extract is a live incident with a friendly name.
How a programme is delivered
Discovery is a workshop with the people who will still be here after go-live: security, BSS, digital, and care. We walk a real journey — a new subscriber, a campaign grant, a care case, a bill — and write down every store it touches. That picture becomes the scope. We do not invent a parallel security architecture that the partner stack cannot run.
Design covers access models, key handling, logging, and retention. Logging has to be queryable by the team that actually sits the Thursday shift, in the console they already use. A SIEM nobody opens is decoration. Retention has to match what campaign, loyalty, and billing are allowed to keep, or you will fail the next audit with three different answers.
Build and configuration stay inside the estate you have. Where Microsoft, Oracle, IBM, or MongoDB already provide the control, we use it and write the operating note. Where the gap is integration — a service account that can see too much, an API that logs too little — we close it as part of the same programme as campaign, CRM, or RBM, not as a follow-on ticket that never gets funded.
Proving it, then leaving it runnable
Testing is not a screenshot of a login page. We prove privilege change, a failed login that must alert, a backup restore, and a campaign extract of a suppressed or restricted segment. Those cases belong in the test plan from week one, beside the functional journeys. Defects are written so a vendor or an internal squad can act: system, data class, expected control, observed gap.
Handover is a written operating practice. Who approves access. How a joiner, mover, and leaver is processed. Which log is the source of truth. What to do when a partner file arrives. The point of certified, repeatable delivery is that the control does not leave with us. Teams we have already sat with — including operators and integrators such as Systems Arabia, STC, Zain KSA, Mobily, Airtel, Maalim Al Khabra, and Smart Solutions — know the difference between a go-live and a system they can still explain a quarter later.
If you are scoping a data, integration, customer-experience, or automation programme and the security work is still a paragraph in someone else’s deck, that is the conversation to have. Share a window that works. A coordinator in Riyadh will return the request at Info@innovacore-tech.com or through the callback form.