Security at Devenisto

This is not a marketing list — every line below is guarded by automated tests that run before each release.

Tenant isolation, three layers deep

Every business record carries its owner. The API checks scope on every request, and beneath it the database enforces row-level security — so even a query that slipped past a check would find no rows that are not the caller's. Automated cross-tenant attack tests run against a restricted database role and must always fail to pass the release gate.

Accounts, roles and immediate revocation

Permissions are granted per role, scoped per branch, with rate-limited logins and MFA support. Revoking a permission takes effect on live sessions immediately — a schedule or a session is never a way to keep access that was taken away.

Financial integrity

Money is stored as integer halalas — never floating point. Invoices, stock movements, wallet and loyalty ledgers and the audit trail are append-only at the database level: triggers refuse updates and deletes, and corrections happen through credit notes and documented adjustments, the way bookkeeping should.

Concurrency, honestly handled

Simultaneous checkouts cannot oversell the last unit; simultaneous refunds cannot exceed what was paid; a coupon at its usage limit cannot be redeemed twice at once. These are not aspirations — they are concurrency tests that fire genuinely simultaneous requests and then audit the arithmetic in the database.

Webhooks and duplicate protection

Outbound webhooks are HMAC-signed with an SSRF guard refusing internal destinations. Idempotency keys are claimed before work begins, so a retried request can never create a second order or charge twice.

Backups that are rehearsed

Backups are only real once restored. Restore drills rebuild a database from backup and verify row counts, financial totals, and that the append-only protections still refuse forbidden writes afterwards.

What we do not claim

We name no external certification we do not hold. For ZATCA e-invoicing, for example, every invoice carries the phase-1 QR today; phase-2 integration (clearance and reporting) is not available yet, and compliance is only ever claimed after a merchant's official onboarding, not before.

Reporting a concern

Found something? Write to support@devenisto.com — security reports are read with priority.