How Hisabi Protects Your Business Data — In Plain English

If you run a UAE business, your accounting data is some of the most sensitive information you own. It's your revenue, your clients, your tax position, and — through receipts and invoices — a window into how your business actually operates. We take that seriously.

This is the security promise we make to every Hisabi customer, written in plain English. No architecture diagrams. No vendor name-drops. Just what we do, why we do it, and what it means for you.

Your Data Is Encrypted — Always

Every piece of data you store in Hisabi — every invoice, every client record, every receipt photo, every email address — is encrypted at rest. That means even if someone physically removed a disk from the data centre, the contents would be unreadable without the keys.

Data is also encrypted in transit. Every connection between your browser and Hisabi uses modern TLS — the same standard your bank uses. Same for the connections between our application and the database, and between us and any payment processor or email provider.

Receipts Are Private — and We Mean Private

When you upload a receipt photo, it goes straight into a private storage bucket. There is no public link to that file. When you view the receipt inside Hisabi, we generate a one-time URL that works for five minutes and then stops working. No one else — not another customer, not a search engine, not a stray employee — can pull up your receipt.

Delete the expense and the receipt is removed in the same request. There's no recycle bin, no shadow copy, no lingering object three years later.

Only You Can See Your Account

Every record in Hisabi is tagged with your user ID. Every database query checks that tag before returning a row. There is no shared workspace where another customer could accidentally see your invoices, no admin shortcut that lets a support agent peek at your numbers without a paper trail.

Even our own engineers do not have routine access to your business data. When access is needed for a support escalation that you've explicitly raised, it's logged, time-bound, and tied to a named individual. The default state is: no one looks.

Your Data Lives in the Region

Hisabi runs entirely on infrastructure based in the Middle East — AWS Bahrain (me-south-1), the same region many UAE banks and government entities use. Your invoices, expenses, receipts, and client records do not leave the region during normal operation.

This matters for two reasons. The first is latency: the page loads in single-digit milliseconds because the servers are next door. The second is alignment with the UAE Personal Data Protection Law (PDPL Federal Decree-Law 45 of 2021) — keeping data inside a region you trust, with clear processing terms, makes your own compliance story simpler.

Every Change Is Audited

If an invoice is edited — a line item changed, a tax rate adjusted, a client TRN updated — the change is recorded. Who did it. When. From what value to what value. The full audit trail is what the FTA expects to see during an audit, and it's also your insurance against a dispute with a client about what was billed.

Audit history is read-only. No one — not you, not us — can edit history after the fact.

Payments Are Processed by Stripe

When a customer pays an invoice, the card details never touch Hisabi. They go directly to Stripe, which is PCI-DSS Level 1 certified — the highest standard for handling card data. We see only the result of the payment and a non-sensitive reference to the transaction. Your customers' card numbers are not ours to keep.

What We Ask of You

Security is a partnership. Use a strong, unique password. Turn on two-factor authentication when prompted. Don't share your login. If you suspect something is off — a receipt you don't recognise, an invoice you didn't issue, an email about a sign-in from a new device — write to us straight away.

We watch for unusual patterns on our side too. New-device sign-ins generate an alert email. Unusual rates of failed logins are throttled. Repeated abuse triggers a temporary block. None of it is foolproof; all of it is layered.

If Something Goes Wrong

If we ever discover that customer data has been improperly accessed, we will tell affected customers directly, in writing, with the facts as we know them and the steps we're taking. The UAE PDPL gives you the right to know; we treat it as the floor, not the ceiling.

More on the legal side: Privacy Policy. More on the product side: Features.