Application controls
- Company records use tenant-scoped database authorization and row-level security.
- Privileged commands recheck the signed-in role, company, and current record state.
- Financial and delivery commands use request identifiers to prevent duplicate mutations.
- Portal access is invitation-based, limited to one customer account, time-bound, and revocable.
- Email and payment provider credentials are designed to remain in server-only environments.
- Webhook handlers verify signatures before applying provider events.
- Data exports require a verified owner and stronger authentication.
Not yet certified
Daftrah does not currently claim SOC 2, ISO 27001, PCI certification, ZATCA Phase 2 approval, “enterprise-grade” security, or a completed independent penetration test. Hosted backup restoration and alert delivery must be accepted before wider launch.
Report a concern
Email contact@daftrah.com with “Security” in the subject. Do not include passwords, one-time codes, private customer documents, or live card data. A formal response SLA and disclosure program still require owner approval.