Security & data

Hosting provider

Hostinger VPS (testing)

Data location

Test server — move to Oracle Cloud Riyadh before launch

• Each company's data is isolated at the database level (row-level security), not only in the app.
• Issued invoices cannot be edited or deleted; corrections are made with credit or debit notes, as ZATCA requires.
• Payment-gateway keys and ZATCA certificates are encrypted at rest and never shown again after saving.
• Card details are entered on the payment provider's page and never reach our servers.
• Daily encrypted backups with point-in-time recovery; restore drills are run regularly.
• You can export all your data at any time, including when you cancel.
• We follow the Saudi Personal Data Protection Law (PDPL).