Security

Payments

Card payments are taken on a Stripe hosted page, so card details never reach Sikkah's servers. We store only what Stripe returns for the record: the card brand, the last four digits and the payment reference.

Bank transfers are paid to the account shown on your quotation. The receipt you upload is kept in private storage, visible only to your organisation and to Sikkah staff who reconcile payments.

No card storage

Sikkah does not store card numbers, expiry dates or security codes. Saved cards are held by Stripe against your organisation's customer record and can be removed from your dashboard at any time.

Encryption

Data is encrypted in transit over TLS and at rest, including the database, backups and uploaded documents. Documents live in a private bucket and are served through short lived signed links, never public URLs.

Access isolation

Each company's data is separated by row level security, keyed to organisation membership. A person who is logged in can read and change only the rows belonging to organisations they are a member of, and the database enforces this on every query. Sikkah staff access is limited to the admin role, and those actions are written to an audit log.

Log in

Log in is by a one time code sent to your work email, so there are no passwords. Codes expire after ten minutes and sessions after thirty days of inactivity. Owners can see active sessions and the last log in for their organisation from the dashboard.

Backups

The database is backed up daily and retained by our provider, so a booking record, document or event can be restored.

Reporting an incident

Report an exposed account, document or payment, or a weakness in Sikkah, to hello@sikkah.ae with the subject Security. We reply with what we found and what we changed.