Security
Draft. This page is written in plain words so you can read what MAJA does with your data and on what terms. It is under legal review and will be settled before the company's registration is complete; the substance will not change — the wording may.
What is in place today
- Encryption in transit (HTTPS everywhere) and at rest on the database and its backups.
- Isolation: every row in the database carries the company it belongs to, and row-level security on the database itself — not only in the app — lets a member read and write only their own company's rows.
- One door per posting: an invoice, a bill, a payroll run, a sale is written by a server-side function in one transaction that checks the rules (the period, the role, the plan, the VAT treatment) before anything is saved — nothing half-written, numbers in sequence.
- Roles and permissions per company, per module and per action; the owner's actions (transfer, close, sign out everywhere) separate from an admin's.
- Two-step sign-in with an authenticator app, required for MAJA staff and recommended for owners.
- An audit trail on every document and every change, and a separate log of every action MAJA staff take on an account, visible to the account's owner.
- Backups daily, with point-in-time recovery on the database.
- The connection light: the top bar shows the live trip time to the server, so a slow or lost connection is seen for what it is; offline, nothing is sent.
What is not yet in place, said plainly
- The data is hosted with an established cloud provider outside the UAE. Hosting in a UAE region is planned; this page will say when it has moved.
- MAJA itself holds no third-party security certificate yet (such as ISO 27001 or SOC 2). Our hosting provider holds its own; we do not claim theirs as ours.
- Card payments are not taken yet; when they are, card details will be handled by the payment gateway and never stored by MAJA.
Reporting a problem
If you find a security problem, write to security@majabooks.com. We answer within two working days and do not take action against anyone who reports in good faith.