Security & privacy
Your data belongs to your business, and none of us reads it without your consent
This page describes what is built into the product. The legal documents (in Arabic): privacy notice, data processing agreement and terms of use.
Isolation and access
Every business isolated
Every row in the database carries its business and the database itself refuses to let one business read another's — tested on every API endpoint.
Support with your consent
Our support team sees your data only in a session you approve each time: read-only, under an hour, ended whenever you like, and you see everything that was read.
Protected accounts
A second factor with an authenticator app or a passkey, a PIN on the till, a role per employee scoped to their branch, and sensitive actions ask for the second factor again.
A log nobody erases
Every write goes to an audit log that refuses edits and deletion; posted entries and issued invoices are corrected by a reversing document, never edited.
Encryption and payments
Encrypted till database
Sales and signing keys on the till are encrypted on the device, and the invoice signing key never leaves it.
Encrypted sensitive fields
IBANs, ID numbers and mobile numbers are encrypted in the database, and keys are rotated without downtime.
No card numbers
The product neither stores nor accepts a card number: from a card payment it keeps the last four digits and the approval code only.
Your data when you cancel
On cancellation a signed package of all your data and files is built for you to download; personal data is then anonymised, and tax documents are kept for the period the law requires.
Personal data protection
We process personal data under the Saudi Personal Data Protection Law and its regulations: each category has its purpose and retention period, a data subject may ask for a copy or for anonymisation of what is not a tax document, and we do not track visitors to this site — no tracking script and no cookie, and the technical request log is deleted after thirty days.
Tax documents and the audit log are kept 11 years after their fiscal year and then destroyed; everything else is deleted or anonymised after a named period per category — the periods and their sources are in the privacy notice (Arabic).