Verified Identity
User and service identities are verified through authoritative identity and IAM sources; tenant or role claims supplied by the browser are not treated as a source of trust.
Security and Compliance
Security Is Not the Last Step of Integration; It Is the Starting Point.
Quibas applies verifiable controls and traceable workflows from user identity and tenant boundaries to enterprise-system connections and critical decisions.
Identity and access control
Tenant isolation
Traceable activity history
Quibas Integration Hub
Governed enterprise connectivity layer
Enterprise Systems
ERP · SAP · API
↔
Integration Hub
Policy and transformation
Supported connection modelsBy scope
REST / JSON
OData V2/V4
SOAP / XML
RFC / BAPI
✓Target and DNS controls
✓Protected credentials
✓Bounded data flow
✓Idempotent job tracking
Verifiable security model
Controls Are Built Into the End-to-End Flow, Not Added as a Separate Layer
Identity, tenant, authorization, connectivity, data transfer and decision records are parts of the same chain of trust. Each control is verified for the relevant system and project scope.
Tenant Boundary
Membership, subscription and action permissions are verified per tenant. Operational records remain tenant-scoped, with RLS and server-side authorization used together in the relevant data layers.
Traceable Activity
Connection, mapping, job, API access and critical state changes are recorded with traceable actor, time, target and outcome context.
Human-Governed Decisions
AI and automation can support preparation, comparison and follow-up, while critical publishing, approval and commercial decisions can remain under authorized user control.
Quibas Integration Hub
Different Protocols, One Governed Integration Layer
Integration Hub separates technical connectivity from business decisions. Connections, schemas, mappings, jobs, retries, idempotency and observability are managed by the Hub, while procurement and risk business rules remain in their owning products.
HTTP authentication options
Bearer
Basic
OAuth 2.0 Client Credentials
mTLS
API key
01Read and write
OData V2 / V4
Metadata and schema discovery, bounded reads and pagination, create operations and ETag-controlled update flows are configured for the selected operation scope.
02SAP
RFC / BAPI + SNC
SAP JCo-based RFC/BAPI connections retain function, tenant, connection revision and credential bindings. When SNC is enabled, encrypted RFC connectivity is managed server-side.
03Inbound and outbound
REST / JSON API
Secure inbound and outbound flows can be established using tenant- and application-bound API access, IP policies, idempotency keys, queued jobs and result polling.
04Contract-governed
SOAP / XML
SOAP/XML connections are configured for verified WSDLs and approved operations. Support is limited to selected SOAP 1.1 document/literal profiles; read and write operations are verified separately for each target system.
Protocol support does not mean every ERP connection is ready or verified in a live environment. Target systems, licenses, network access and approved operations are confirmed for each project.
Secure data flow
No Direct Browser-to-ERP Connection
Connections established through the Hub run with identity and policy context verified server-side. Business results are not written directly to product tables; they are delivered to the verified contract of the owning product backend.
✓Tenant and action authorization are determined by the backend.
✓Successful acceptance does not imply external execution is complete; the result is tracked separately.
✓Retries are applied only when an operation is proven safe or idempotent.
1
Verified request
Identity · tenant · permission
→
2
Integration Hub
Mapping · job · policy
→
3
Allowed target
OData · RFC · API
Record
Correlation and job status
Result
Delivered to owner backend
Decision
Human approval and follow-up
Defense layers
Not Just Connecting, but Operating Within Secure Boundaries
Every integration is bounded by target, credentials, data volume, operation type and error behavior. The exact control scope is verified against the customer architecture and the enabled connection profile.
Target and network control
Allowed targets and origins, DNS validation, redirect policy and connection preflight checks restrict unexpected outbound access.
Credential security
Secret values are not stored in connection metadata or activity logs; protected references and governed rotation flows are used.
Bounded I/O
DNS, connection and response timing; request, response and payload sizes; batch and concurrency limits are enforced from trusted configuration.
Idempotency and reconciliation
The same key and content resolve to the same job, while conflicting replays are rejected. Ambiguous outcomes are tracked and reconciled rather than retried blindly.
Safe errors and activity records
Users receive stable, safe error codes; stack traces, credentials, target URLs, raw payloads and remote error bodies are not copied into user messages or activity records.
Secure development objectives
Integration Hub development uses OWASP ASVS 5.0 Level 2 objectives, the OWASP API Security Top 10 and the WSTG testing approach. These are design and verification targets, not claims of independent certification.
ASVS L2 targetAPI Security Top 10WSTG
Compliance Is a Project Scope, Not a Badge
KVKK and GDPR requirements are evaluated together with data roles, purpose of processing, retention, deletion, subprocessors, data residency and customer responsibilities. Relevant documents and technical controls are clarified for the contract and project scope.
KVKKGDPRProcessing scope
Security FAQ
Common Questions in Enterprise Reviews
No. ERP and other systems of record remain the source of transactions and master data. Quibas Integration Hub establishes governed data exchange with those systems, while Data Intelligence and Procurement IQ manage decision and operational flows.
RFC/BAPI profiles use SAP JCo. Where SNC is required, the partner identity, relevant library and server-side configuration are verified. RFC traffic is not assumed to be encrypted when SNC is disabled; the security model is explicitly defined for the customer SAP environment.
Integration Hub stores a reference to the protected secret rather than the secret value itself in connection records. Secret values are not redisplayed in the interface or copied into activity logs, user-facing errors or technical metadata.
AI and agents operate only within defined tool, data and workflow boundaries. Critical approvals, publishing, supplier selection or commercial decisions can remain under authorized user control, with owner and rationale retained for traceability.
Enterprise security review
Let us review your architecture, integration scope and control requirements together.
Before the project, we can clarify data flows, connection methods, tenant and IAM models, retention, subprocessors and the technical verification plan.