Trust · Security · Data residency
Where your data lives, layer by layer.
“Hosted in Oman” is easy to say and usually means only the edge server is local. So here is the full picture: which layer runs where, how it is protected, who can see it, how long we keep it, and how you get it all back.
Last updated
Data residency
Every layer, and exactly where it runs.
Residency is only meaningful if it covers the database, the application, the backups and the logs. Here is each one.
Your database
Inside OmanEvery Amaal customer record, employee file, invoice and project lives in a database running in cloud infrastructure located inside Oman.
The Amaal application
Inside OmanThe application servers that read and write that database run in the same in-country infrastructure. Requests are not processed abroad.
Backups
Inside OmanBackups are encrypted and stored inside Oman. Residency covers copies, not just the live database.
Application logs
Inside OmanOperational and audit logs stay in-country alongside the system that produced them.
This marketing website
Global CDNamaal.om is a set of static pages served from a global content delivery network, so it loads fast anywhere. It holds no customer data, no logins and no database. It is deliberately separate from the product.
Security controls
How the data is protected once it is here.
Encrypted in transit and at rest
Every connection is protected with TLS. Personal records and uploaded documents are encrypted while stored on disk.
Passwords are hashed, never stored
Passwords and security secrets go through a one-way hash. They cannot be read back, recovered or decrypted, including by the Amaal team.
Least-privilege access
Access is role-based and least-privilege by default. A field officer cannot open payroll; a viewer cannot edit. Each organisation's data is isolated from every other.
Everything is audited
Who viewed, changed, exported or deleted what, and when, is written to an audit trail across every module.
Backups and patching
Regular encrypted backups, network hardening, monitoring and routine patching guard against intrusion and loss.
Export is a button, not a favour
An authorised administrator can download a full copy of the database and every file at any time. Your data is never leverage in a dispute or over payment.
Your rights and our duties
Who is responsible for what.
You stay the owner
Your business remains the controller of the personal data it chooses to collect. Amaal is the processor that keeps it lawful, secure and in-country on your behalf, and takes responsibility for the compliance of the platform itself.
Access, correction and deletion
Individual requests to see, correct or delete personal data are supported in-product by your administrators. Where you need our help to answer one, email us and we will work to your deadline under Oman's Personal Data Protection Law.
If something goes wrong
Amaal investigates suspected incidents immediately, contains them, and notifies affected customers without undue delay with what we know, what is affected and what we are doing. The audit trail is what makes that account possible.
Security and privacy contact
Email contact@amaal.om for security reviews, privacy questions, data-residency due diligence, the data processing agreement, or a suspected vulnerability. The same address is published in machine-readable form at /.well-known/security.txt. Please report vulnerabilities privately and give us a reasonable window to fix them before disclosing.
Postal: 205 (SBC), Liwan Asafinah, Al Marafah St, North Al Ghubrah, Muscat 119, Oman. Phone and WhatsApp: +968 9730 2812.
Trust FAQ
Security and residency: straight answers
Where does Amaal store customer data?
Amaal stores customer data in cloud infrastructure located inside Oman. The application servers, the database, the encrypted backups and the application logs are all in-country, so employee, client and financial data does not cross a border. The amaal.om marketing website is separate: it is a set of static pages served from a global content delivery network and holds no customer data.
Is Amaal's data residency independently verified?
No public scan can verify where a private database or backup lives, and Amaal does not claim otherwise. What is on this page is Amaal's own written statement of where each layer runs. For contractual assurance, ask Amaal for the data processing agreement and hosting details in writing before you buy.
Why does amaal.om resolve to a server outside Oman?
Because the marketing website and the product are two different systems. amaal.om is static marketing content on a global content delivery network, which is why a network lookup can show an edge server abroad. It contains no customer data, no logins and no database. The Amaal application and its database run in cloud infrastructure inside Oman.
Are Amaal backups also kept in Oman?
Yes. Amaal backups are encrypted and stored inside Oman, as are application and audit logs. Data residency that covers only the live database and not its copies is not residency, so Amaal treats backups and logs the same way.
Can we get our data out of Amaal?
Yes, at any time and without asking. The Amaal admin portal lets an authorised administrator download a complete copy of the database together with every uploaded file. There is no exit fee and no hostage clause: data is never held as leverage in a dispute or over non-payment.
How long does Amaal keep our data after we leave?
Your data stays available for export throughout your subscription and for an agreed wind-down window after it ends, after which it is deleted from live systems and ages out of encrypted backups. The exact retention schedule is set out in the data processing agreement, which Amaal provides in writing on request.
Who do we contact about a security issue at Amaal?
Email contact@amaal.om with security, privacy or data-protection matters, including suspected vulnerabilities and data-residency reviews. The same contact is published in machine-readable form at https://amaal.om/.well-known/security.txt. Please report suspected vulnerabilities privately and give us a reasonable window to fix them.
