Safi Trust Center

Available today

• Approval before posting

  A financial action does not execute until the user approves it.

• Invoice QR scope

  For VAT-registered sellers, Safi can generate an invoice QR payload containing TLV tags 1–5. That does not establish complete Phase 1 compliance, which has not been independently verified. Phase 2 clearance and reporting are unavailable. VAT-return figures are preliminary and incomplete, require customer review, and are not filed by Safi.

• Figure boundary

  Figures and reports are based on records approved or imported in Safi.

Processors and cross-border processing

Cross-border processing may occur. We state observable code behavior and do not turn a configuration or provider name into proof of a location, contract, or retention term.

• Supabase and the database

  The application uses Supabase for account data, books, and conversations. The actual processing location, retention, and data processing agreement are pending external verification.

• Vercel and hosting

  Vercel hosts the application and processes requests. The actual processing location, retention, and data processing agreement are pending external verification.

• OpenAI and the assistant

  Assistant conversation and the business context needed to fulfil a request are sent to OpenAI with store: false. This does not establish zero retention. Location, retention, and a data processing agreement are pending verification.

• PostHog and analytics

  Browser PostHog does not load until explicit consent for analytics. The current identity is pseudonymous from user or company IDs; current identity properties do not include name or email. Location, retention, and a data processing agreement are pending verification.

• Google Ads acquisition measurement

  The Google Ads tag does not load until explicit analytics consent. Advertising storage, advertising user-data, and ad-personalization consent remain denied. The exact page URL, query fields, and measurement properties sent to Google Ads are pending runtime and vendor verification. Location, retention, and a data processing agreement are pending verification.

• Vercel Web Analytics

  Vercel Web Analytics does not load until explicit analytics consent. Processing location, retention, and a data processing agreement are pending verification.

• Chatwoot and optional support

  Chatwoot runs only when configured. For an authenticated user it may receive a stable identifier, name, and email to connect a conversation with support. Location, retention, and a data processing agreement are pending verification.

• Moyasar payments

  Moyasar provides the browser payment form and card tokenization, plus recurring payment-token APIs. Card details are entered into Moyasar's form; Safi code receives payment and token identifiers, masked card metadata, and amount, currency, and callback context, not the raw PAN or CVC. Production activation, location, retention, contracting entity, and a data processing agreement are pending verification; cross-border processing may occur.

• Resend and transactional email

  The code uses Resend for verification, recovery, and service email when sending keys are configured. Production activation, processing location, retention, and a data processing agreement are pending verification.

• Axelor optional synchronisation

  If a business enables the optional Axelor integration, selected accounting records are mirrored to a customer-nominated server. The destination and location are pending per business, and the integration remains disabled unless configured.

Your data and rights

• Data export

  Settings provides a link to download a ZIP export of company data and the signed-in user's private data.

  /api/account/export

• Data requests

  For access, correction, erasure, or a question about your data, contact support. Some records may remain under Safi's current retention behavior; its duration, scope, and statutory sufficiency are pending qualified Saudi legal and tax review.

• Analytics consent

  You can accept or decline browser analytics in the banner. It starts off until you explicitly choose.

Service boundaries

• Not advice

  Safi is a bookkeeping tool, not accounting or tax advice. The customer remains responsible for reviewing figures, obligations, and filings.

• Selling and billing

  The contracting entity, seller of record, and production billing activation are pending verification. Displayed prices are not evidence of production selling readiness.

What we do not claim

• Entity and agreements

  The legal entity, commercial and VAT registration numbers, and data processing agreements are pending verification.

• Certifications and assurances

  We do not claim certification, blanket compliance with Saudi personal-data law, residency limited only to KSA, or bank-level encryption. Legal and Security review have not yet been recorded.

• Support level

  Support channel availability, hours, and a service-level agreement are pending verification; there is no current public commitment.

Change history and review

• 4 September 2026

  The Trust Center was reconciled with the processing register and consent gate that delays PostHog, Google Ads, and Vercel Web Analytics, plus Moyasar, Resend, optional Chatwoot and Axelor, and the existing data export.

• When we review

  We review when a processor, sent data, hosting, or entity changes, or at the next scheduled review.