Security & data protection

Your data, protected.

Sash runs your whole business, so we treat your data the way you'd expect — encrypted in transit and at rest, backed up, isolated per company, and always yours. Here's exactly how.

How we protect your business

Built-in from day one — not a checkbox added later.

Encryption & EU data centres

Your data is encrypted in transit (TLS) and at rest — the database and uploaded files sit on a full-volume AES-encrypted disk — hosted in ISO 27001–certified EU data centres. Passwords are hashed, never stored in the clear.

Encrypted nightly backups

The database and your uploaded files are backed up automatically every night to encrypted storage, and are recoverable.

Tenant isolation

Every company's data is isolated. One customer can never see another's records — enforced on the server, not just the screen.

Role-based access

Fine-grained permissions per module and action, plus configurable maker-checker approvals so the right people sign off.

Immutable audit trail

Every create, update and delete is written to a change log — who did what, when — so nothing happens without a record.

Document authenticity

Letters, certificates, invoices and POs carry a QR anyone can scan to confirm they're genuine — anti-fraud by design.

UAE data residency

Your data can be kept in the UAE on a dedicated deployment, available on request — talk to us about residency for your compliance needs.

No ads, no data-selling

We don't show ads and we don't sell your data. Your business information is yours, handled with PDPL-aware care.

Your data is yours

Export any report to Excel or CSV, access-controlled, any time. No lock-in on your own data.

Questions about security or residency?

Talk to the team that builds Sash — we're happy to walk your IT or finance lead through the details.

Contact us →