Security

Draft text, to be finalised after legal and security review.

Company isolation

Every company's leads, listings, deals and files are separated in the database itself. Staff only see what their role allows, and those rules are checked on the server, not only in the app.

Sign-in

No passwords: invite-only sign-in with a 6-digit code sent to your email (valid 5 minutes, single use), bot protection, attempt limits and temporary lockouts. A sign-in from a new device triggers an email with a one-click "sign out everywhere" link. Admin and finance accounts use an authenticator app, and sensitive actions such as exports or role changes ask for it again.

Sessions and devices

Inactive sessions end automatically. Each user can see signed-in devices and sign out everywhere; admins can sign a colleague out.

Files

Photos and documents are stored privately, checked before upload, renamed randomly and opened through links that expire within minutes. Location data is removed from photos.

Audit log

Sign-ins, exports, role changes, deletions and file actions are recorded in a log that nobody, including admins, can edit.

Encryption

All traffic to DealOS uses HTTPS (TLS). Data and files are stored with our hosting provider's encryption at rest. We do not add a separate application-level encryption layer on top of that today.

Backups

The database is backed up automatically by our hosting provider. Our restore procedure is documented and rehearsed internally; deleted company data is purged on a fixed schedule.

Data handling and the UAE

We follow the principles of the UAE Personal Data Protection Law: we collect only what brokers need, each company controls its own data, and people can ask for a copy or deletion of their personal data. Data is hosted with a cloud provider that may store it outside the UAE; contact us if your brokerage needs a specific region.

What we do not claim

DealOS does not currently hold ISO 27001, SOC 2 or similar certifications, and is not affiliated with DLD, RERA, Bayut, Property Finder or Dubizzle.

Reporting a problem

Found a vulnerability? Email security@dealos.ae. Please give us reasonable time to fix it before sharing details.