Resources

Security and data

This page describes what EXO Estates does today, as built and tested. Where something is not in place yet, we say so at the end of the page.

Signing in

Passwords must be at least 15 characters. We do not force symbols or capitals. We refuse passwords that only look long, such as repeated patterns, keyboard runs, your company's name or your own email address.
Passwords are never stored. We keep only a memory-hard scrypt hash, with a unique random salt for each password.
After eight wrong attempts an account locks for 15 minutes, then unlocks by itself. Repeated failures from one network source are slowed down as well.
Back Office users can add authenticator-app codes with ten single-use backup codes. Your administrator can make them mandatory for chosen roles.
A sign-in attempt does not reveal whether an email address has an account, or which app it belongs to.

Sessions

A session ends after 30 minutes of inactivity, and always within 12 hours.
The session cookie travels only over HTTPS, cannot be read by scripts on the page, and is not sent by other websites.
You can sign out of one device or everywhere. Changing a password, or an administrator disabling an account, ends every session for that account at once.

Who can see what

Access is by role: administrator, manager, leasing, finance, procurement, supervisor, technician, contractor, owner and tenant. Each role holds a defined set of permissions.
Each account opens only the app its role belongs to. A contractor or tenant account cannot open the Back Office.
Tenants see only their own lease and payments. Owners see only their own units. Contractors see only orders issued to them. Technicians see only their own jobs. These limits are applied by the server, not by hiding buttons.
Payments, purchases and write-offs are never approved by the person who raised them; a work order within its raiser’s own limit can proceed without a second signature. Each role has its own approval limits, and amounts above the highest internal limit go to the owner.

Separation between companies

Separation between companies is enforced in the application on every request and covered by tests. Each company's records are read and written only for that company's signed-in users.

A record of every change

Every change is recorded with who made it and when.
The application cannot edit or delete the audit trail. Entries are sealed in a hash chain with a daily copy kept outside the database, so any later alteration shows.
Identity numbers and tax registration numbers are kept out of the audit trail. The trail records that they changed, not their values.
Business history is not deleted. A correction needs a stated reason, and undoing a record leaves a trace.

Personal data

Emirates ID, passport and tax registration numbers can be recorded but are never displayed back. Cheque numbers are never shown in full.
Tenants and other app users can delete their account from inside the app or through a web request. Their sign-in details are erased. Leases, receipts and similar business records stay with the company, and the person is told this before confirming.
Enquiries from your public website are kept apart from your tenant register until your staff convert them.
Spreadsheet exports are protected against formula injection and keep Arabic text intact.

Documents and files

Uploads are limited to images (JPEG, PNG, WebP) and PDF, checked by the file's actual content rather than its name.
File locations are never sent to the browser, and files are served only to users allowed to see them.

How the software is built

Every request that changes data carries a unique key, so a repeated click or a retried connection is never applied twice.
If two people edit the same record, the second save is stopped and shown what changed. It never silently overwrites.
An automated test suite checks these rules. A dedicated check sends every data-changing request unexpected input and fails if any of them errors.
Every screen works in English and Arabic, with full right-to-left layout.

On our roadmap

Hosting provider and region: not yet selected. Keeping data in the UAE is our intended direction, and we will publish the provider and region once decided.
Encryption of stored data, backup frequency and recovery time objectives depend on the hosting decision. We will publish them with it.
We do not publish an uptime commitment or support hours yet.
We do not hold ISO 27001, SOC 2 or similar certifications, and no independent penetration test has been completed yet.
Uploaded files are not yet scanned for malware.
Separation between companies is not yet also enforced inside the database (row-level security). It is on our roadmap.
Authenticator-app codes are not yet available in the tenant, owner, contractor and technician apps.
Self-service password reset is not available yet. Your administrator issues a temporary password, which must be changed at the next sign-in.
Messages to tenants are prepared and queued automatically and sent by your team. Automatic sending through an email, SMS or WhatsApp provider is not yet connected.

Questions about security or data? Ask our team.Ask our team

Keep exploring

See it with your own portfolio.

Ask for a 30-minute walkthrough. Tell us what matters to your business and we’ll reply by email to agree a time — with sample data or an extract of your own, in Arabic or English.

Request a demo View pricing