Security
Compliance software has to earn trust in its own data handling
Multi-tenant isolation, access control, and audit trails are built into the platform's foundation, not layered on after the fact.
Full audit trail
Every key action, written down and reviewable
Sign-ins, invites, role changes, invoice sends, payments, voids — every one is written to an append-only log your team can review directly, not reconstructed after the fact from scattered application logs.
How we protect your data
Defense in depth, by default
Every organization on Fisclyra gets these protections — there's no separate 'enterprise security' tier.
Database-enforced tenant isolation
Every tenant-scoped table is protected by Postgres Row-Level Security, not just application-level filtering — a forgotten query filter fails closed instead of leaking another organization's data.
Role-based access control
Every teammate is scoped to exactly the permissions their role needs, from full ownership down to read-only audit access — enforced on every request, not just hidden in the UI.
Hashed credentials, always
Passwords are hashed with bcrypt. Session tokens and password-reset links are opaque random values — only their SHA-256 hash is ever stored, so a database compromise doesn't leak usable tokens.
Hosted, PCI-light payments
Subscription billing runs through Stripe's hosted Checkout and Billing Portal — card details never transit or touch Fisclyra's servers.
Rate-limited authentication
Login, signup, and password-reset requests are rate-limited per source, closing off brute-force and credential-stuffing attempts.
Full audit trail
Every key action — sign-ins, invites, role changes, invoice sends, payments, voids — is written to an immutable audit log your team can review.
Tamper-evident invoice chain
Every ZATCA invoice is cryptographically signed and hash-chained to the one before it, per legal entity — nothing can be inserted, reordered, or altered after the fact without breaking the chain.
Encrypted compliance secrets
ZATCA signing keys and certificates are encrypted at rest with AES-256-GCM. Plaintext key material exists in memory only for the single signing call that needs it — never written to disk or logged.
Immutable, verified archive
Once an invoice is sent, its exact PDF and data snapshot are archived once and SHA-256-verified — what was archived is what downloads, every time, with no silent regeneration.
Questions
Need details for a security review?
If your team needs specifics on our architecture, data handling, or a particular compliance requirement for procurement, reach out and we'll walk through it directly.
Ready to simplify compliance and accelerate growth?
Discover how Fisclyra can transform your e-invoicing and fiscal compliance operations.