Security overview

Last updated: 1 Nov 2026

Architecture

A single web application with a relational database; all traffic encrypted (TLS), sessions in a signed cookie the browser’s scripts cannot read, ending at sign-out or after 12 hours.

Controls in place

• Passwords hashed with bcrypt, sign-in throttling, single-use time-limited verification and reset links.
• Cross-site request forgery protection, a strict content-security policy and standard security headers.
• Uploaded files validated by signature rather than extension, with size limits.
• Role-bounded permissions per waqf and an access log for every sign-in.
• A decision log sealed in a SHA-256 chain that reveals any later alteration.
• No language model computes money: shares come from a deterministic engine reading the approved card.

What we do not claim

We hold no certified information-security attestations yet (such as ISO 27001 or SOC 2) and display none before obtaining them. Any independent audit or certificate is published here once granted.

Reporting a vulnerability

Write to the security address given in the contract or through the support page; we acknowledge within two working days and keep you informed of the fix.

For contractual and legal enquiries: through the quote request page or the support address in your contract.