Last updated 28 Aug 2026
Maaliya Accounting and Bookkeeping DWC-LLC ("Maaliya", "we", "us" or "our") processes financial, accounting and business information on behalf of its customers.
We recognise that this requires appropriate safeguards around access, infrastructure, authentication and data handling.
This Security & Trust Policy ("Policy") explains the technical and organisational measures Maaliya uses to protect its Services and Customer Data, our approach to infrastructure resilience and security incidents, and how security researchers can responsibly report potential vulnerabilities.
Maaliya uses a combination of application-level controls, cloud infrastructure, authentication mechanisms and operational procedures designed to protect Customer Data.
Our approach includes:
Security is an ongoing process. We may modify and strengthen these measures as Maaliya, its technology and the risks affecting the Services evolve.
No online system can guarantee absolute security.
Traffic to Maaliya's websites, applications and APIs is protected using HTTPS/TLS where applicable.
This helps protect information transmitted between users, Maaliya and relevant infrastructure from unauthorised interception while in transit.
Customer Data stored within Maaliya's production infrastructure is protected using encryption-at-rest capabilities provided by our applicable infrastructure and storage providers.
These controls are designed to reduce the risk of unauthorised access to underlying stored data.
Maaliya does not describe its security as "unbreakable", "military-grade" or otherwise guarantee that encryption eliminates all security risk.
Maaliya is a multi-tenant platform.
Customer Data is logically separated between organisations and workspaces using application and database-level access controls.
These controls are designed so that users authenticated to one organisation cannot access another customer's information through normal application functionality.
Maaliya uses controls including database access policies and row-level security where appropriate to enforce tenant-level separation.
We treat cross-customer access as a security boundary.
Maaliya uses role-based access controls ("RBAC") to restrict functionality and information according to the user's authorised role.
Different roles may include, depending on the relevant Service:
Customers are responsible for assigning appropriate permissions to their users and removing access when it is no longer required.
Maaliya also applies access controls internally so that personnel do not receive unrestricted access to Customer Data merely because they work on the platform.
Access to identifiable Customer Data is restricted according to operational need.
For managed accounting and Done-For-You services, access to a customer's accounting information is generally limited to the customer's assigned account manager and other personnel whose role directly requires access.
Technical personnel may access production systems or Customer Data where reasonably necessary to:
Access is governed by internal permissions and least-privilege principles.
Maaliya supports authentication controls designed to prevent unauthorised account access.
Depending on the relevant account and Service, these may include:
MFA is available for customer accounts where supported.
Maaliya requires appropriate MFA controls for applicable internal and administrative systems.
Customers should enable available security controls and maintain secure access to the email accounts, devices and authentication methods connected to Maaliya.
Sensitive application credentials, API keys and service credentials are managed separately from publicly delivered application code.
Maaliya uses environment variables and other appropriate mechanisms for managing application secrets.
Privileged service credentials, including applicable database service credentials, are intended to remain server-side and are not intentionally exposed through Maaliya's frontend applications.
Access to sensitive credentials is restricted according to operational requirements.
Maaliya maintains separation between production and development or testing environments.
Production access is restricted to personnel whose roles require it.
Developers may access production infrastructure where necessary for authorised troubleshooting, maintenance or development activities, subject to applicable access controls.
Maaliya does not intentionally use real Customer Data in development or testing environments.
This separation is designed to reduce unnecessary exposure of production information during software development.
Maaliya's source code is maintained in private repositories with access restricted to authorised personnel.
Repository access is managed according to role and should be removed when an individual's access is no longer required.
Our development practices include controls such as:
These processes may evolve as our engineering organisation and Services grow.
Maaliya maintains logs relating to relevant system and user activity.
Depending on the relevant feature, these may include:
Where supported, audit trails allow Maaliya and/or customers to identify the user responsible for material changes to accounting information.
Maaliya also monitors relevant logs and alerts to identify operational or security issues and to support investigation where necessary.
Logging does not mean that every action or potential security event will necessarily be detected.
Maaliya uses third-party cloud and infrastructure providers to operate portions of the Services, including providers such as Supabase and Render.
These providers supply underlying infrastructure capabilities that may include:
Responsibility for security is therefore shared across Maaliya, its infrastructure providers and customers.
Maaliya remains responsible for the security controls that fall within its application and operational responsibilities.
Maaliya uses infrastructure providers that provide backup, redundancy and/or recovery capabilities for relevant production systems.
These provider-level mechanisms help protect against certain infrastructure failures and data-loss scenarios.
However, unless expressly agreed otherwise, Maaliya does not provide customers with a guaranteed customer-specific backup service, guaranteed point-in-time recovery, or a particular recovery point objective.
Infrastructure recovery capabilities may vary by provider, service, configuration and subscription.
Customers remain responsible for retaining independent copies of documents, exports and records they are legally or operationally required to preserve.
Maaliya's backup and infrastructure-resilience arrangements should not be treated as a replacement for a customer's own record-retention obligations.
Maaliya's Services depend partly on third-party cloud, infrastructure, internet and technology providers.
If an infrastructure provider experiences an outage or failure, Maaliya's technical team will take reasonable steps to assess the issue and restore affected functionality, including working with or relying on the relevant provider's restoration and recovery capabilities.
Maaliya does not currently commit to a specific recovery time objective ("RTO") or recovery point objective ("RPO") unless expressly agreed in writing.
While we design the Services with reliability in mind, we do not guarantee uninterrupted or error-free availability.
Service availability remains subject to Maaliya's Terms of Service and any separately agreed service commitments.
Maaliya's technical team is responsible for investigating suspected security incidents affecting the Services.
Where we become aware of a suspected incident, we may take reasonable measures appropriate to the circumstances, including:
The exact response will depend on the nature, severity and scope of the incident.
If Maaliya becomes aware of a confirmed personal-data breach affecting Customer Data, we will notify affected customers without undue delay where required by applicable law or contractual obligations.
Where reasonably available, notifications may include information concerning:
Information may be provided progressively where all relevant facts are not immediately available.
Maaliya does not commit under this public Policy to a universal fixed notification period such as 24, 48 or 72 hours where such a deadline is not otherwise required by applicable law or contract.
Security is a shared responsibility.
Customers are responsible for taking reasonable measures to protect their use of Maaliya, including:
Customers should not share credentials between users.
Where a customer deliberately grants another person access to its account or connected systems, actions performed using that authorised access may be treated as actions performed on behalf of the customer.
We welcome good-faith reports from security researchers, customers and other members of the security community who believe they have identified a vulnerability affecting Maaliya.
Potential security vulnerabilities should be reported privately to:
A useful report should, where reasonably possible, include:
Please provide sufficient information for our technical team to understand and reproduce the issue.
Security research involving Maaliya must be conducted responsibly.
Researchers must not:
Testing should, wherever possible, be limited to accounts and information owned or controlled by the researcher.
If security research unexpectedly results in access to another customer's information or other personal or confidential data, the researcher must:
Researchers should provide Maaliya with enough information to investigate the vulnerability without unnecessarily reproducing or transmitting exposed Customer Data.
Maaliya does not intend to pursue legal action against security researchers solely for good-faith security research that complies with this Policy.
This statement applies only where the researcher:
This does not authorise access to third-party systems, infrastructure or data, and does not waive the rights of any third party.
If you are uncertain whether a proposed test is permitted, contact Maaliya before conducting it.
Maaliya does not currently operate a public bug-bounty programme.
Submitting a vulnerability report does not create an entitlement to payment, compensation or any other reward.
Maaliya may choose to recognise or reward a particularly helpful report at its discretion, but no financial reward is promised or guaranteed.
Security controls reduce risk but cannot eliminate it.
Maaliya does not represent or warrant that:
Our objective is to implement safeguards appropriate to Maaliya's Services, data and operating environment and to continue improving those safeguards as the platform develops.
Maaliya may update this Security & Trust Policy as our technology, infrastructure, security controls and Services evolve.
Changes may reflect:
The date at the top of this Policy indicates when it was last updated.
For security questions or to responsibly report a suspected vulnerability, contact:
Maaliya Accounting and Bookkeeping DWC-LLC, Trade Licence No. TL 14812, Floor 3, Tower A3, Dubai South Business Park, Dubai, United Arab Emirates.
Security reports: support@maaliya.ae