Shamel Hub

Security and your data

Plain answers to the questions business owners and their auditors ask before trusting a system with their books. Updated as our setup changes.

Live service status

  1. Where your data lives

    Your books are stored in a PostgreSQL database on servers operated for Shamel Hub in the region we publish on the status page. Uploaded files (logos, attachments, captured receipts) are stored separately in object storage. Each company's records are isolated at the database level by row-level security, so one customer can never read another's rows, even through a programming mistake.

  2. Who can see it

    Only the users you invite, with the roles you give them. Every action that changes a record is written to an audit log with who, when and what. Our support staff see your data only when you open a ticket and ask for help, and that access is logged.

  3. How it is protected

    Traffic is encrypted in transit (TLS). Passwords are hashed, never stored. Two-step verification is available for every user and required for console administrators. ZATCA private keys, two-factor secrets and integration keys are encrypted at rest with keys kept outside the database. Sign-in is rate-limited and locks after repeated failures.

  4. Backups

    The database is backed up nightly as a full dump, together with uploaded files, kept for a rolling window and copied off-site. Restores are tested against a scratch database, never over production. Point-in-time recovery covers the hours between backups.

  5. Your data is yours

    At any time the account owner can export everything: customers, suppliers, products, invoices, payments, journals and files, in open formats (Excel, CSV, JSON, PDF). Nothing is locked in, and we never use your books to train AI models.

  6. Closing an account

    The owner can close the account from Settings → Data and privacy. We keep the data for 30 days in case you change your mind, then delete it, except what tax law requires us to retain for the legal period, which stays sealed and read-only.

  7. Compliance

    Shamel Hub is integrated with ZATCA's Fatoora platform for Phase 2 e-invoicing. Invoice XML, hashes and the submission log are kept as evidence for the legal retention period. VAT, withholding tax and zakat reports follow the current regulations.

  8. Reporting a problem

    Found a security issue? Email hello@shamelhub.sa and we will answer within one business day. Please do not test against other customers' accounts.