Security and data handling
What Mutabiq does with an invoice file, what it keeps and for how long, where it runs, who its sub-processors are, how accounts are protected, and what it does not have. Every line describes the product as it is; the privacy policy is the legal document.
The invoice file
- An invoice XML, a ZIP of them, or a PDF/A-3 with the XML inside, is checked in memory for the duration of the request and discarded when the response is sent. It is never written to disk, to a database or to a log, and never sent to anyone else.
- A file is read strictly as UTF-8, and a declared encoding other than UTF-8 is refused. The XML parser runs with document type definitions and entity expansion disabled, and the schema check runs against the UBL 2.1 schemas that ship in ZATCA's SDK.
- The verdict comes from deterministic code only. No language model decides it, and the product uses none.
What is stored
- Your account: the email address you sign up with, your organisation name, and usage counts.
- For each check, what the upload leaves: who ran it and when, the kind of file, the rule pack version, the verdict, the number of files, the invoice type code, and each finding's rule id, severity, XPath, value class and explanation key, with the entry's position for a ZIP. No invoice value is recorded: a value class says “empty” or “not 15 digits”, never the value itself.
- Any label you type for a check (client, branch or reference), stored with the check and visible to your organisation.
- Findings metadata, with the record of the check it came from, is deleted automatically 12 months after the check. When an account is deleted, its data is deleted within 30 days, and you can delete your account yourself from the Members page. An organisation that still has other members keeps its own usage counts and findings metadata.
- No invoice content or value is ever logged. A check's log line carries rule ids, counts and timings; operational logs carry request ids, status and error codes.
Where it runs
The check runs on Vercel's servers in Frankfurt (region fra1). Account data and findings metadata are held by Supabase, in Frankfurt. Account data is therefore stored in the European Union; Mutabiq does not offer hosting in Saudi Arabia.
Sub-processors
The privacy policy lists every sub-processor with what it does. The two hosts publish security attestations of their own; those are theirs, not Mutabiq's:
- Supabase (database and authentication, Frankfurt): its security page and its data processing addendum, as it publishes them.
- Vercel (hosting): its security and sub-processor page and its data processing addendum, as it publishes them.
- Paddle (payments), Cloudflare (DNS and email routing) and Resend (sign-in emails) are on the privacy page with what each does.
Organisation owners are emailed at least 30 days before a sub-processor is added or replaced, except where a change is needed urgently for security, in which case as soon as practicable.
Accounts and access
- Sign-in is by a one-time link sent by email. There is no password.
- Two-step sign-in with an authenticator app (a 6-digit TOTP code) is optional. Once an account has enrolled one, the database itself refuses that account's data to any session that has not passed the second step, not only the app.
- Every table has row-level security. The key the browser holds grants nothing beyond what those policies allow; the key that bypasses them is read only by server code and has a written rotation procedure.
- An organisation owner can restrict invitations to named email domains.
- An API key is shown once and stored only as a SHA-256 hash. A revoked key is refused at once, and each key has a rate limit of its own.
In the browser
Every response carries Strict-Transport-Security, X-Content-Type-Options nosniff, a frame-ancestors policy that lets no site frame a page, and a Permissions-Policy that refuses camera, microphone, location and USB. A full Content-Security-Policy is sent in report-only mode while its reports are read; it blocks nothing yet.
What Mutabiq does not have
- No SOC 2 or ISO 27001 report of its own, and no penetration test report. The hosts' attestations are theirs, linked above.
- No published uptime figure and no service-level agreement. The status page gives one live answer and links to each provider's own status page; it does not yet publish history.
- A data processing agreement has been drafted for counsel's review; none is offered until counsel approves it and it is linked from the privacy policy.
- No hosting in Saudi Arabia.
Reporting a security issue
Write to support@hayatiq.ai, in English or Arabic. The same contact is published in security.txt.