// Legal
Security
Your financial and operational data is critical to your business. Security is built into how we design, build and operate Tapat.link.
Last updated: September 1, 2026
Hosting in Saudi Arabia
Tapat.link runs in data centres located in the Kingdom, with redundant power, networking and physical access controls.
Encryption
All data is encrypted in transit with TLS 1.2 or higher and at rest with AES-256. ZATCA signing keys are stored encrypted and never leave your tenant.
Tenant isolation
Each customer runs in a logically isolated environment with its own database, so your data is never mixed with another customer's.
Access control
Role-based permissions, optional two-factor authentication and IP restrictions protect your account. Internal access to production systems is limited, logged and reviewed.
Backups and recovery
Encrypted backups run daily with point-in-time recovery. We regularly test restores to ensure your data can be recovered.
Monitoring
Systems are monitored around the clock, and every change to your data is recorded in an audit trail visible to administrators.
Responsible disclosure
If you believe you've found a security vulnerability, email security@tapat.link. We investigate every report and will keep you informed.