Security Schedule
Working version 2026-10-25.v2 – legal review pending
This Schedule describes how we protect the data that we process in Zolia for you and for your brokerage. It forms part of our Terms of Use and our Office Terms and applies in addition to our Data Processing Terms. It describes, and does not reduce, our obligations under Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data.
Hosting and location
- S1.1 We store and process the data in Zolia with Microsoft Azure in the region UAE North (Dubai): the servers, the database, the file storage, the encryption keys, the logs and the backups. The services that read text in documents and convert speech to text also run in UAE North.
- S1.2 Data leaves the UAE only in these cases:
- (a) AI models: pseudonymised content of AI tasks is processed by Amazon Bedrock in data centres in the European Union; other regions are blocked;
- (b) system e-mails: sign-in codes, notifications and e-mails to our help desk pass through Amazon Simple Email Service in Frankfurt, Germany;
- (c) identity checks: when a brokerage starts an identity check in a KYC case, the person being checked uploads the documents to our identity verification provider in the European Union (Ireland); we move the result to the brokerage's encrypted KYC vault in the UAE right after the check and have it deleted at the provider, at the latest after one month;
- (d) WhatsApp: messages that you or your brokerage send or receive through your own WhatsApp Business account pass through Meta as your own provider.
- S1.3 Our website zolia.ai is hosted separately and does not process the data in Zolia. The app is served from our environment in the UAE.
Encryption
- S2.1 In transit: all connections are encrypted. The app is served only over HTTPS (TLS) with HTTP Strict Transport Security; the file storage accepts only TLS 1.2 or higher; the database accepts only encrypted connections.
- S2.2 At rest: the database and the file storage are encrypted by the platform; the file storage additionally uses a second layer of encryption at the infrastructure level.
- S2.3 Additional encryption of sensitive data: identity documents, KYC fields and confidential files are additionally encrypted with keys specific to each brokerage or personal space. The master keys are RSA keys in a hardware security module of Microsoft Azure Key Vault (Premium, FIPS 140-3 Level 3) in UAE North; they cannot be exported and are rotated automatically every 12 months.
- S2.4 Deleted keys can be recovered for 90 days and cannot be removed for good before then (purge protection).
Pseudonymisation and AI
- S3.1 Before any content is sent to an AI model, Zolia replaces e-mail addresses, phone numbers, IBANs, card numbers, identity numbers, names known to Zolia and other personal details with placeholders. The mapping stays in our environment in the UAE and is not written to logs.
- S3.2 Identity documents and identity-check data are never sent to an AI model.
- S3.3 Permissions are checked before any data reaches an AI model.
- S3.4 AI models are not trained with the data of your clients.
Access control
- S4.1 Users: sign-in with passkey or one-time code; role-based permissions within each brokerage; sessions and devices can be ended at once.
- S4.2 Separation: every brokerage and every personal space is separated in the database by row-level security on every table, and also in file storage, search, background jobs and AI processing.
- S4.3 Our staff: administrative access is personal, protected with a second factor and logged; there is no shared administrator account. Servers can be reached only through an encrypted administrator network; the server ports for remote access are closed to the internet. The database cannot be reached from the internet. The file storage accepts access only from our servers and only with an identity of our environment; storage keys are switched off.
- S4.4 No access by default: our staff and the AI tools we use for development and office work have no access to the data in Zolia. Support staff access a space only with the approval of the customer for a specific request, for a limited time and with logging, or where strictly necessary for security or by law, with information afterwards.
- S4.5 Logging of sensitive access: every view of KYC data is logged.
Testing and evaluation
- S5.1 Every change to the code is checked automatically for secrets, known vulnerabilities in dependencies and container images, and unsafe code patterns; critical findings, and high findings older than 14 days, stop the release. A full scan runs every week.
- S5.2 The separation of brokerages is covered by automated tests.
- S5.3 We test the restore of the database every month and run a recovery exercise at least every six months, and an incident exercise once a year.
- S5.4 Before real identity data is processed, an independent tester carries out a penetration test.
Availability and recovery
- S6.1 The database is backed up automatically and can be restored to any point in time within the last 35 days. The backups are stored redundantly across availability zones in Dubai.
- S6.2 Files are versioned; deleted files and folders can be restored for 35 days. Records that must not be changed are kept in storage with write protection.
- S6.3 Our targets are a data loss of at most 1 hour and a restart within at most 8 hours after a serious incident. These are targets, not a guaranteed availability.
- S6.4 We limit the number of requests per address, space and function, and alerts inform us of errors and delays.
Personal data breaches
- S7.1 We notify the brokerage (as controller), or you for your personal space, immediately after we become aware of a personal data breach affecting its or your data, and in any event send a first notice within 24 hours, even if information is still incomplete.
- S7.2 The notice describes, as far as known, the nature of the breach, the categories and approximate number of persons and records concerned, the likely consequences, the measures taken or proposed and a contact person. We provide updates and document each breach with a timeline.
- S7.3 We support the controller in its own notifications to the UAE Data Office and to the persons concerned.
Staff and sub-processors
- S8.1 Everyone at Biturai L.L.C-FZ with access to data is bound by a written duty of confidentiality and has access only as far as needed for their tasks.
- S8.2 We use these sub-processors:
- Microsoft (Azure)
- servers, database, file storage, key management, text recognition, speech, logs, backups
Location: UAE North (Dubai) - Amazon Web Services
- AI models (Amazon Bedrock), pseudonymised; system e-mails and receipt of help-desk e-mails (Amazon SES)
Location: European Union; Frankfurt, Germany - Didit
- identity checks in KYC cases started by a brokerage
Location: European Union (Ireland), at most one month
- S8.3 We tell you in the app at least 30 days before we add or replace a sub-processor. If you object, you can stop using the functions concerned or end the contract before the change.
Retention and deletion
- S9.1 When you delete your account, we delete its data 30 days after your request; copies in backups expire within a further 35 days.
- S9.2 When a brokerage stops using Zolia, it can export its data; we then delete the data of the brokerage, destroy its keys and let backups expire within 35 days, unless the law requires us to keep data for longer.
- S9.3 Application logs are kept for at most 90 days, security logs (sign-ins, rejected access, access to keys, administrative changes) for 365 days. Logs are kept without personal content where possible; e-mail addresses, phone numbers, identity numbers and IBANs are removed automatically.
Law, changes and evidence
- S10.1 This Schedule describes our obligations under Federal Decree-Law No. 45 of 2021, in particular Articles 8, 9 and 20, and does not reduce them.
- S10.2 We may adapt the measures to technical progress only if the overall level of protection is not reduced. We describe material changes in a new version of this Schedule.
- S10.3 On request, we provide the information needed to show that we keep to this Schedule, including summaries of security tests.