Security at PettyCash

Your financial data is protected with industry-standard security measures.

Data Encryption

All data transmitted between your device and PettyCash servers is encrypted using TLS 1.2+ (Transport Layer Security). Data at rest is encrypted using AES-256 encryption. This means your financial data is protected both in transit and in storage, meeting the same security standards used by banks and financial institutions.

Access Controls

PettyCash implements role-based access control (RBAC). Each user has a defined role with specific permissions. Administrators can control who can view, create, edit, or delete petty cash funds, transactions, and reports. Sensitive actions require additional authentication. Passwords are hashed using bcrypt and never stored in plain text.

Audit Trails

Every action in PettyCash is logged in an immutable audit trail. This includes who created, modified, or deleted a transaction, when the action occurred, and what changed. Audit trails cannot be modified or deleted by any user, ensuring a complete and tamper-proof record for compliance and fraud investigation purposes.

Data Hosting & Infrastructure

PettyCash data is hosted on Google Firebase infrastructure, which is certified under ISO 27001, SOC 2/3, and ISO 27017. Data is backed up automatically and stored in multiple geographic locations for disaster recovery. Our infrastructure provider maintains 99.9% uptime SLA.

Data Privacy

We never sell your data to third parties. Your financial data belongs to you and is only used to provide the PettyCash service. We comply with Saudi data protection regulations. See our Privacy Policy for full details.

Vulnerability Reporting

We take security vulnerabilities seriously. If you discover a security issue, please report it to security@pettycash.site. We acknowledge all reports within 48 hours and provide updates as we investigate and remediate.

⚠️ Legal Review Notice

This security page should be reviewed by a qualified legal professional before publication. The information provided here describes our current security practices but does not constitute a legal guarantee or SLA. Consult with your legal team to ensure compliance with your specific regulatory requirements.