Security
Tenant data deserves real protection
Property records contain lease terms, salaries, bank details, and home addresses. Here is exactly how we keep that data safe — in plain language, with the technical detail included.
Isolated by architecture
Each company operates inside its own PostgreSQL schema — a separate namespace for tables, indexes, and records. Tenant resolution, role authorization, and database schema boundaries work together to reduce cross-organization access risk.
No passwords to steal
Sign-in uses a short-lived one-time code rather than a reusable account password. Rate limits and session controls reduce automated abuse; users must still protect their email account and never share an OTP.
Abuse protection built in
Authentication and application APIs use IP- and principal-aware request limits. Security headers, restricted cross-origin access, role checks, and audit events provide additional layers.
Encrypted in transit and at rest
Production traffic must be served over HTTPS, and storage encryption, backups, restoration objectives, hosting region, and document-retention requirements are confirmed for the customer deployment and agreement.
Why physical isolation matters
The most common SaaS data breach doesn't involve a hacker — it involves a missing query filter. Architecture decides how bad that mistake can get.
Every customer's rows live in one table, separated only by a tenant_id filter in application code.
- One missed WHERE clause exposes other customers’ data
- Heavy queries from one tenant slow everyone down
- Restoring or exporting one customer is a special project
Each company gets its own PostgreSQL schema — a physical boundary the database itself enforces.
- Schema boundaries reduce dependence on row filters alone
- Indexes and maintenance are scoped to your data alone
- One-click export or restore of a single customer, any time
Operational security questions
Security details can differ by deployment. Before signing, ask for the controls and commitments that apply to your organization.
Privacy & compliance
We prefer specific commitments over certification logos. Here is what we do, and what it supports.
UAE data protection
We design our data handling to support the requirements of UAE Federal Decree-Law No. 45 of 2021 on the protection of personal data.
GDPR-friendly controls
Tools for data export and deletion requests, so you can respond to your own data-subject obligations quickly.
Ejari-aligned workflows
Lease registration and renewal workflows built around Dubai Land Department requirements and official Ejari documentation.
A complete audit trail
Logins, contract executions, and financial events are recorded in an append-only audit log you can review at any time.