TRUST CENTRE

Your Data. Our Responsibility.

Full transparency on how we protect your financial data. No vague promises — specific controls, real certifications, and honest timelines.

Security Certifications

SOC 2 Type II

In Audit — Q3 2026

ISO 27001

Assessment Phase — Q4 2026

UAE PDPL Compliant

Active

GDPR Aligned

Active

Data Residency

Your data is encrypted and access-controlled

Your data is hosted on Supabase (AWS) with encryption in transit and at rest, isolated per tenant by row-level security. Current primary region: AWS ap-south-1 (Mumbai). UAE in-country residency (AWS me-central-1) is on our roadmap.

Region

AWS ap-south-1 (Mumbai)

Provider

Supabase Hosted

Encryption

Data at rest

AES-256-GCM

Industry-standard symmetric encryption applied to your database, file uploads, and all backups.

Data in transit

TLS 1.3

All connections use the latest transport encryption. Older TLS versions are rejected.

Passwords

bcrypt + salt

One-way hashing ensures passwords are never stored in plaintext. Even our engineers cannot read them.

Salary data

RLS + role-gated

Employee salaries and sensitive compensation data are isolated per tenant by row-level security and a write-role guard, and encrypted at rest with the database. Field-level encryption with separate keys is on our roadmap.

Access Controls

Role-based access control (RBAC)

7 granular roles — Owner, Admin, Accountant, Auditor, Sales, HR, Viewer. Each role sees only what they need.

Two-factor authentication (2FA)

TOTP-based 2FA via Google Authenticator, Authy, or 1Password. Required for Owner accounts on Enterprise.

Session timeout

Configurable auto-logout after inactivity (15 minutes to 8 hours). Protects unattended workstations.

IP allowlist

Restrict access to specific IP addresses or ranges. Ideal for office-only access policies.

Tamper-proof audit log

Every action logged with user, timestamp, IP, and before/after values. Append-only — no one can delete entries.

Track every successful and failed login with device, browser, and IP. Export to CSV anytime.

Uptime & SLA

99.9%

Uptime Commitment

Our infrastructure is designed for high availability. Service credits apply if we miss this target.

4 hrs

P1 Response Time

Critical incidents (complete service outage) receive a response within 4 hours, 24/7.

Data Export — Leave Anytime

Leave anytime. One click. All your data.

Export every byte of your financial data in CSV, JSON, or PDF format. No lock-in, no waiting period. We delete your tenant from production within 30 days of cancellation.

CSVJSONPDF

Sub-processors

SupabaseDatabase & Authentication

Location: India (ap-south-1)

VercelCDN & Edge Network

Location: Global

OpenAIOCR & AI Features

Location: USOpt-in only — disabled by default

This list is updated when sub-processors change. Last reviewed: April 2026.

Contact

Data Protection Officer

For PDPL requests, data subject access requests, or privacy inquiries.

dpo@emirateerp.com

Security Team

To report vulnerabilities, request our security questionnaire, or discuss compliance requirements.

security@emirateerp.com

Ready to move your finances to a platform you can trust?

Also read our Security, Privacy Policy, and Terms of Service.