Trust
How Tahiyya protects your data
This page says what is built today and what is planned, without claims. We do not name a certification we do not hold.
Built today
- A permanent audit history: every sensitive action (request, task, correction, support sign-in) carries who, what and when, and cannot be edited or deleted.
- Corrections keep the original version forever, with who corrected it and why.
- Each hotel’s data is separated at the database level (row-level security), with permissions by role.
- Encrypted connections, hashed PINs, and "sign out everywhere".
- A PDPL toolkit: data-subject requests, a record of processing, retention schedules and the 72-hour incident clock.
- Support staff enter a hotel only with that hotel’s permission, for a set time, and every sign-in is logged.
- The demo hotel runs on synthetic data only.
Planned (not done yet)
- Hosting inside the Kingdom (Google Cloud Dammam or equivalent) before any real hotel.
- An independent penetration test before the pilot.
- ISO/IEC 27001, then SOC 2 Type II: a planned path, no certificate yet.
- Disaster recovery through a second region, after in-Kingdom hosting.
Our promise
- You will not read the word "certified" here before it is true.
- The status page shows the platform working, minute by minute.