Trust Center
Security and governance you can check.
Every statement on this page is labelled for what it is — an implemented feature, a verified infrastructure capability, a plan or a regulation. No decorative badges.
How to read this page
- Verified company status
- Verified infrastructure capability
- Product feature
- Integration readiness
- Planned capability
- Third-party certification
- Regulatory requirement
Security architecture & data isolation
How your organization's data is kept separate and protected.
- Product feature
Tenant isolation in the database
Each organization's records are separated by PostgreSQL row-level security. The application's database role cannot read another organization's rows.
- Product feature
Products keep their own data
Your MAPEX account holds identity, organization and billing. Each product keeps its business data in its own database and receives only what it needs to open your workspace.
- Product feature
Encryption in transit and for secrets
All traffic uses TLS. Sensitive secrets such as authenticator keys and integration credentials are encrypted before they are stored.
Access control
Who can sign in, what they can do, and the record of what they did.
- Product feature
Two-step verification
Every MAPEX account can turn on an authenticator app. It is required for regional partner accounts.
- Product feature
Roles and separated permissions
Owner, admin and user roles in each organization, with billing limited to owners. Product permissions stay separate from the organization role.
- Product feature
Session control and sign-in protection
Sessions expire when idle and after a maximum lifetime, repeated failed sign-ins are locked out, and you can sign out other devices at any time.
- Product feature
Audit logs
Sign-ins, invitations, role changes, billing and security events are recorded with who, what, when and from where. Your organization's activity log is available in your MAPEX account.
Hosting, backups & monitoring
Where MAPEX runs and how it is kept recoverable.
- Verified infrastructure capability
Hosted on Mahsumah Cloud
MAPEX Hub runs as its own managed-hosting account on Mahsumah Cloud, Mahsumah's infrastructure service, with its own databases, storage, logs and backups — nothing shared with other customers.
- Verified infrastructure capability
Backups before every release
A backup of the production databases and files is taken automatically before every production release, stored inside the MAPEX account.
- Planned capability
Scheduled backups and restore checks
Daily backups with defined retention and a weekly restore check are defined in the MAPEX backup policy and are being enabled on the servers.
- Product feature
Health checks
Every MAPEX service exposes a health check used to verify each release after deployment.
Privacy & data ownership
Your data, your control.
- Product feature
Your data stays yours
Your business data belongs to your organization and is processed only to provide the service. Suspending an organization blocks access — it does not delete data.
- Product feature
Limited, audited partner access
Regional partners see only the organizations in their own region, customer emails are masked by default, and every reveal or sensitive action is audited.
- Product feature
No tracking cookies on this website
This website uses no advertising or tracking cookies. Page views are counted with a daily-rotating one-way hash, without storing your IP address for analytics.
AI controls
How APEX AI is designed to stay inside your rules.
- Planned capability
AI inside your permissions
APEX AI is designed to act as the signed-in user: it sees only what that user can see, shows a preview before any change, and records AI-assisted actions in the audit log.
Compliance
Company status, regulation and certifications — stated separately, never merged.
- Verified company status
A product of Mahsumah Technology Company
MAPEX Hub is a product ecosystem of Mahsumah Technology Company, a company of the Kingdom of Saudi Arabia. It is not a separate legal entity.
- Regulatory requirement
Saudi Personal Data Protection Law (PDPL)
MAPEX Hub is built to support the law's requirements with technical controls such as purpose limitation, least privilege, masking and audit. The organisational programme is held by Mahsumah. This is not a certification.
- Product feature
VAT invoices per country
MAPEX subscriptions are invoiced by the billing company of your country, in its currency and at its VAT rate: 15% in Saudi Arabia, 14% in Egypt.
- Integration readiness
ZATCA e-invoicing
Integration is planned. MAPEX Hub is not certified or connected to the ZATCA e-invoicing platform today. Each product is checked against its country's e-invoicing rules before it is marked available.
- Third-party certification
Third-party certifications
MAPEX Hub does not hold third-party certifications such as ISO/IEC 27001 or SOC 2 today. Certifications held by Mahsumah Cloud apply to Mahsumah Cloud, not to MAPEX Hub.
MAPEX Hub and Mahsumah Cloud
Mahsumah Cloud is a separate Mahsumah product: the infrastructure and managed-hosting layer MAPEX Hub runs on. Its registrations, partnerships and policies belong to Mahsumah Cloud and are published on its own site.
Mahsumah Cloud trust & complianceSecurity questions
For security or privacy questions about MAPEX Hub, email us and mention “Security” in the subject.
Saudi infrastructure · Security · Compliance
Built in Saudi Arabia, on foundations you can verify.
- A product of Mahsumah Technology Company, Saudi Arabia
- Isolated hosting on Mahsumah Cloud
- Row-level tenant isolation
- Two-step verification & audit logs
- SAR billing with 15% VAT invoices
- Arabic-first support, 24 hours
Runs on:PostgreSQLTLS (AutoSSL)cPanel managed hostingTOTP (RFC 6238)