Security
Every answer below describes the system as it runs today.
Sample dataWhere it runs
Every request arrives over HTTPS.
HTTP is redirected. HSTS is on.
Microsoft Azure, UAE North
Confirmed region
Confirmed
The production application.
One outbound address.
Behind one fixed outbound address you can allowlist.
Access control
The restricted row never uncovers.
| Reference | Department | Net |
|---|---|---|
| EMP-0142 | Operations | AED 13,275.00 |
| EMP-0187 | Finance | AED 19,110.00 |
| EMP-0203Restricted | Engineering | Net: Restricted |
| EMP-0219 | Operations | AED 8,967.00 |
Illustrative, in dirhams. No name column — rows are keyed by reference.
Employee data
HR
The whole company.
Manager
Their own team, and nothing outside it.
Employee
Their own attendance, leave and payslips.
Not a data scope
Admin
Configuration.
End of service stays HR-only.
Setting up your account runs through a separate platform role, and every permission check that guards employee data refuses it.
Your data’s boundary
Your company
Inside: reads its own records
Outside: gets none of your records
Leavers
One access token · one hour
Re-checked on every request, not on a timer. Refresh tokens rotate on every exchange.
Documentation
Encryption, backups, sub-processors, a data-processing agreement — put the question your procurement needs answered in an email and it gets answered by a person, in writing.
Ownership
Exporting them is a button.
The obligation to keep those records is yours, wherever you employ people, and it does not transfer to a vendor.
Every module
Comes out as
Nothing stands on that path — no payment, no notice period, no request.
Hosting, leaving, reporting a problem.
Microsoft Azure, UAE North. The production application runs in the UAE, behind one fixed outbound address you can allowlist. Push notifications pass through Google’s and Apple’s services, outside the UAE.
Export is never put behind a payment. Ask what happens when a subscription lapses, and we will answer in writing.
Email info@mowazaf.com and say it is a security report. It is read by a person and answered within one business day.
Start
Look around the real product in the sandbox, or send us your security questions and get a written answer.
Mowazaf Connect: up to 30 employees. No card required. The sandbox is a shared demo company that resets every night.