Data Processing summary

• The application and its MongoDB database run on DigitalOcean cloud infrastructure, managed by us.
• Uploaded files (documents, drawings, photos) are stored privately in Cloudflare R2 and served only through short-lived signed URLs — there is no public file bucket.
• Background work (email delivery, scheduled jobs, backups) runs on a separate worker process from the API.

• TaameerPro is multi-tenant: each customer organization is a tenant identified on every request.
• Organization scoping is enforced at the data layer — a tenant plugin applies the organization filter to queries on tenant-scoped collections, so cross-tenant reads are prevented structurally, not per-endpoint.
• Client and vendor portal access uses separate, limited-scope tokens that expose only the records the organization has explicitly shared.
• Role-based access control governs what each user can see and do inside a workspace, including finance-restricted data.

• All traffic between browsers and the Service is encrypted in transit (HTTPS/TLS).
• Passwords are hashed with bcrypt; they are never stored or logged in plain text.
• Two-factor authentication (TOTP) secrets are stored encrypted.
• Session refresh tokens are stored hashed, rotated on use, and revoked on reuse detection.
• File storage and backup objects are held in Cloudflare R2, which encrypts stored objects at rest.

• Full database backups run automatically on a schedule and are stored as archives in Cloudflare R2, separate from the production server.
• Backups are kept on a rotating window — a fixed number of recent snapshots is retained, and older ones are deleted as new ones succeed.
• Backup failures alert the operations team by email.

• Significant actions in a workspace (creations, status changes, financial approvals, logins) are written to a per-organization audit trail retained for 90 days and visible to workspace administrators.
• Platform-level administrative actions are recorded twice: in a platform audit log (retained 12 months) and in the affected organization's own audit trail.

• Workspace data lives for as long as the account is active; downgrading a plan never deletes data.
• Self-serve account deletion starts a 30-day grace period (reactivation possible), after which the organization's data is permanently purged by a scheduled job.
• Purged data disappears from backups as the rotating backup window advances.
• Read in-app notifications are auto-deleted after 90 days.

The complete list of third parties that process customer data on our behalf:

We do not use advertising or analytics providers, and we will update this list before introducing a new subprocessor.

We do not currently hold formal certifications such as SOC 2 or ISO 27001, and we do not claim compliance frameworks we have not been audited against. Everything on this page is a factual description of how the system is built today.

If your procurement or security team needs more detail than this page provides, contact us via the contact page and we will answer questionnaires directly.