Security

Your records, kept exact and kept safe.

A business's books are its memory. Here is how we protect them, and what you control.

Till code accepted
Ifrah · Enrolled till · Market Branch
08:02
Protection · Hodan TradingAll on
Encrypted in transit and at restOn
Point-in-time copyOn
Wrong till codes before lock5
Tills enrolled4
Every change has a name next to it.
How we protect records

Six things we do every day.

Encrypted everywhere

Records are encrypted between your device and our servers, and again where they are stored. Backups are encrypted too. Coming

Copied as it changes

Our database host keeps a continuous copy of every change, so records can be restored to an earlier point in time. Coming Planned: a regular restore drill, with the date of the last one shown on the status page. Coming

Access by role

Each person sees only what their role allows: owner, manager, cashier or accountant. A cashier works only at their own till. Owners decide who has which role.

Sign-in protection

A till code locks for 15 minutes after 5 wrong tries, and works only on a till the owner has enrolled. Sign-in attempts are limited, and sessions end after 2 hours without use. Planned: two-step sign-in with a code from a phone app for owners and accountants. Coming

Every change is recorded

Who did what, when and from which device. Corrections are new entries, so nothing is quietly overwritten.

Status in public

Each part of the service is checked every minute. The results feed the public status page, with 90 days of history. Coming

Audit trail

Every change has a name next to it.

The audit trail cannot be edited through Diwaan, by anyone. Owners and accountants can search it by person, kind of record or date.

Audit trail · Hodan TradingRead-only
Hodan Ali24 Oct, 15:40
Recorded a payment of $12,500.00 from Northgate Traders on INV-2272Laptop
Faadumo Yusuf24 Oct, 14:55
Paid out $482.10 from the Main Store till: Porters for the Dalsan deliveryTill 1, Main Store
Abdi Warsame24 Oct, 10:42
Transfer T-0318: 24 units, Warehouse to Market BranchPhone
Abdi Warsame23 Oct, 20:10
Closed the day at Market Branch. Cash matches: $3,575.38Till 1, Market Branch
Your control

What you decide.

  • Who can sign in, and what their role allows
  • Which devices can act as tills
  • Exporting all your records, at any time, in standard formats
  • Closing your account. We keep records for 90 days, then delete them

Planned: signing out a lost till from Settings, and requiring two-step sign-in for your business. Coming Coming

Responsible disclosure

Found a weakness? Tell us first.

We welcome reports from security researchers and respond to every one. Coming

Report tohello@diwaan.app
  • We confirm receipt within two working days
  • We keep you informed until the issue is fixed
  • We credit you publicly, if you would like that
  • Please do not access other customers' data or disrupt the service while testing

Questions about security?

Write to hello@diwaan.app. The security team reads every message. Coming

Contact us