Security and privacy at Rawaj
Your commercial data is sensitive. These safeguards are built into the platform's foundations, not bolted on later.
Tenant and company isolation
Every record belongs to one customer account, and the system refuses any data link across accounts. Inside an account each company is separated, and staff see only the companies they're allowed to.
Two-factor sign-in (MFA)
Time-based one-time codes (TOTP) for owners, admins and financial operations.
Fine-grained permissions
Ready-made roles with separate rights to read, write, publish and approve — and nobody approves their own work.
Hash-chained audit log
Every action records who, when, and the before and after, with entries chained by hash so tampering shows.
Encrypted tokens
Platform tokens are encrypted at rest and in transit, and never appear in logs or AI prompts.
Kill switch
Stop all external writes and spend instantly, per account, connector or agent.
Separate approvals
Independent sign-offs for publishing, bulk price changes, new campaigns, budget increases and bulk messages.
Separated environments
Test environments are kept apart from production accounts, with encrypted backups.
Regulation and personal data
We are aligning the platform with Saudi Arabia's Personal Data Protection Law and with the terms of every platform we integrate, and we review regulatory requirements with specialists. We do not claim any compliance certification we haven't obtained.
Reporting a vulnerability
If you find a security issue, email hello@rawajai.com and we'll handle your report confidentially.
Start organising your commerce today
14-day free trial. Set up your companies, import products and try the daily plan yourself.