Trust & security · Masrouf for Work

• Your account, receipts and packs are encrypted in transit and at rest, with providers certified to SOC 2 and ISO 27001.
• Your receipts are private to your account. An agency you join sees a pack only once you finish it.
• Claude, by Anthropic, reads your receipts to file them. Anthropic does not train on them.
• We never sell your data, show you ads or track you with cookies.
• Download or delete your data whenever you like, from Settings.

Your account, receipts, periods and packs are kept with Supabase, and the application runs on Vercel. Both state AES-256 encryption at rest and TLS in transit.

Some of it passes through or is handled by other providers: every request through Vercel’s delivery network; the AI reading at Anthropic; and WhatsApp messages, emails and the human check on Meta’s, Google’s and Cloudflare’s own networks.

Where each provider keeps or handles your data is set out in the privacy policy: Where your data is kept, and transfers.

• In transit: every page and request uses HTTPS, and browsers are told to accept nothing else (HSTS).
• At rest: the database and receipt files are encrypted by our hosts. Supabase and Vercel each state AES-256 at rest and TLS in transit.
• WhatsApp: messages reach us through Meta’s Cloud API, which Meta states is encrypted in transit and at rest, and we accept a message only when it carries Meta’s signature.

• You see everything in your account. Other users see nothing of it, apart from an agency you join.
• An agency, only after you accept its invitation: your name, email, initials and firm, the date you joined and whether you are active; the dates, stage and history of periods in progress (never their contents); and every pack you finish under it. You can leave at any time.
• Our administrator sees the accounts list and usage, and opens an account’s data only to support you, answer a privacy request, fix a fault or stop abuse.
• Your browser never reads the database directly: apart from signing in, every request goes through our application, which checks who you are and shows each account only its own data.

Claude, made by Anthropic, reads what you send so it can file it: date, shop, amount, currency and expense code. You can correct anything it reads, and an uncertain read is flagged for you to check.

We send it the file or the text, with your expense codes, today’s date, your time zone and your default currency. Never your name, email address or phone number.

Anthropic’s terms forbid training on what we send. It deletes requests and answers within 30 days; a request its safety systems flag can be kept up to 2 years, and its safety scores up to 7 years.

• Sell your data, or share it for advertising.
• Show you ads, or track you with analytics or advertising cookies.
• Train AI on your receipts.
• Send you marketing, by email or on WhatsApp.

• Download: Settings → Privacy & data → Download my data, your data and receipt files in one zip.
• Delete: a receipt or a period in the app, or everything with Delete account. Deletion is immediate here. Database backups roll off within 7 days, copies at Anthropic and Meta within 30 days, and the few records the privacy policy lists are kept for the time it states.
• STOP: reply STOP on WhatsApp, or use the switch in Settings, to turn off the reminders and notices an agency asks us to send. START turns them back on.
• Correct: change any receipt or setting in the app.

• Row-level security on every database table, with no public access.
• Passwords of at least 10 characters, kept only as a one-way hash by our sign-in provider; your current password is needed to change it or delete your account.
• Rate limits and a human check: limited attempts at sign-ups, password resets and password changes, read budgets per account, and Cloudflare’s check on the sign-in, sign-up and reset forms.
• Keyed hashes: to count attempts we keep keyed codes (HMAC) of an email address, network address or phone number, not the values themselves.
• Scrubbed logs: email addresses, long numbers and keys are removed from our logs.
• Checked uploads: files are typed by their content, capped in size, pages and pixels, and JPEG, PNG and WebP photos are stored without their location and camera data.
• Retention purges: records kept for a fixed time, such as security records and message logs, are deleted by a daily job once that time is up.
• Backups: Supabase takes a daily backup of the database, kept 7 days.

Masrouf is built on providers certified to the standards below, each as stated on the provider’s own trust or compliance page. The certifications are theirs. Masrouf itself holds no certification and has not yet had an independent audit or penetration test.

No system is perfectly secure. If a breach affects your data, we notify each regulator the law requires within its deadline (72 hours in Qatar, Saudi Arabia and the EU, for example), and tell you without undue delay what happened and what to do, whenever your law requires it. We record every breach in a register. Supabase and Anthropic have each agreed to tell us of a breach on their side within 48 hours.

Found a weakness? Write to expenses@masrouf.ai with “Security” in the subject.

• Include what you found, the page or address, the steps to reproduce it, and what someone could do with it. Screenshots help.
• We reply within 5 working days, tell you what we will do, and let you know when it is fixed.
• In scope: masrouf.ai and my.masrouf.ai. Our providers’ own systems are not ours to authorise; report those to them.
• Please test only with your own account, stop and tell us as soon as you reach anyone else’s data, and do not use denial of service, spam, social engineering or physical access. Give us 90 days, or until it is fixed if sooner, before you publish.
• Safe harbour: if you follow these rules in good faith, we treat your research as authorised and will not take legal action or complain to the authorities about it.
• We do not pay rewards. We are glad to thank you by name once it is fixed, if you would like.

Machine-readable: masrouf.ai/.well-known/security.txt.