Tenant-aware records, role-based operating boundaries, controlled posting, evidence preservation and audit-oriented workflows.
SECURITY · PRIVACY · CONTINUITY
Your ledger is your business. Our controls must earn access to it.
This page separates controls already designed into Maliyati from assurance work that must be completed before production onboarding. We will not convert a roadmap into a badge.
Final hosting and data-residency statement, backup and restore testing, retention policy, penetration testing and published service targets.
ISO 27001 and SOC 2 readiness work. Maliyati is not currently represented as certified under either standard.
Permission before action.
Maliyati is designed so roles and approvals determine who can view, prepare, post, approve and execute sensitive work. Posted financial and compliance records follow controlled workflows rather than silent edits.
A production statement will precede production data.
Maliyati does not currently publish an unsupported claim of in-Kingdom data residency. The production hosting region, backup location and relevant subprocessors will be disclosed before Saudi production onboarding.
RPO and RTO must be proven, not invented.
RPO is the maximum acceptable data-loss window. RTO is the target time to restore service. Maliyati will publish both only after the production backup design and restore tests demonstrate achievable numbers.
Testing before certification language.
An independent penetration test is planned before production onboarding. ISO 27001 and SOC 2 are assurance objectives; certification will only be claimed after completion by the appropriate independent bodies.
PDPL work is part of release readiness.
The production privacy policy, data-processing terms, retention schedule, exit export and deletion process will be approved before production customer onboarding. Customer business data will not be described as available for unrelated model training.
DIRECT QUESTIONS
Request the current assurance position.
We will answer security and architecture questions directly and update this page as controls are verified.