Security & Trust

Your business records — every company database, uploaded document and backup — are stored on servers in Riyadh, Saudi Arabia, hosted by Alibaba Cloud (Saudi Cloud Computing Company). Saudi customers' data stays in the Kingdom, in line with the PDPL. A few supporting services (e-mail delivery, error monitoring, phone push notifications) operate outside the Kingdom and handle limited operational data; they are listed in our Privacy Policy.

These measures apply to every Tadbir account:

• Each company has its own separate database — your records are not in a shared table with another customer's.
• All traffic uses TLS/HTTPS. Identity numbers, bank account numbers (IBAN) and stored integration credentials are encrypted in the database with AES-256-GCM.
• Tadbir has role-based permissions by module and by user: you decide what each user can view, edit or approve.
• Sign-in is locked after repeated failed attempts.
• Passwords are stored hashed with bcrypt, never in readable form.
• You can sign in with a passkey instead of a password.
• An audit trail records changes — who changed what, and when.

We do not hold an ISO 27001 or SOC 2 certificate today. If a certificate is a condition of your purchase, ask us before you sign.

Databases and uploaded files are backed up daily. In a serious failure, at most the last day's changes could be lost.

Our staff open your workspace only to resolve a support request, and actions taken through our admin panel are logged. We do not sell your data.

Tadbir meets ZATCA Phase 1 e-invoicing requirements. Every invoice is generated with the ZATCA QR code and an XML copy, and kept unaltered. Connection to ZATCA's Fatoora platform (Phase 2) is coming.

Your data belongs to you, and you can export it from the platform while your subscription is active.

After a subscription ends, your business data is kept for 90 days so that you can export it, and is then deleted; backup copies are overwritten within a further 90 days.

After a free trial ends, the workspace becomes read-only and the data is kept so that you can subscribe or export it. You can ask us to delete it at any time.