Trust & security

Every item below is implemented in the product and covered by automated tests.

• Tenant isolation is enforced on the server for every request; your organization ID comes from the session, never from the browser.
• Passwords are hashed with bcrypt; login is rate-limited per account and per IP, with constant-time checks.
• Password-reset, email-verification, and invitation links are single-use, time-limited, and stored only as hashes.
• Sensitive fields (commercial registration, phone) are encrypted at rest with AES-256-GCM.
• An append-only audit log records sensitive actions with the real client IP; no API can edit or delete entries.
• Security headers ship in production: a strict Content-Security-Policy, HSTS, frame-ancestors none, and nosniff.
• Uploads are restricted by type and size, stored privately, and served through short-lived (5-minute) signed links.
• The AI assistant is scoped to a single organization and never mixes data across tenants; customer data is not used for training.

• Raqib is hosted for Saudi data expectations; the specific hosting region is confirmed with you before onboarding.
• The AI assistant sends only limited context (organization name, business type, and item titles/statuses) to the model provider — never your documents, and it can be turned off per organization.
• This use of an AI provider is a cross-border transfer under PDPL and is disclosed in the privacy notice and DPA.
• A Data Processing Agreement with a subprocessor list is available for paid engagements.

• We are not SOC 2 or ISO 27001 certified. An external audit is planned, not completed.
• We have not yet completed an external penetration test.
• We are not endorsed, approved, or certified by any regulator. Raqib maps to published requirements; it does not represent any authority.
• We do not use vague labels like “bank-grade” or “military-grade”. We describe the actual controls above.