Trust & security

• Your bills, files and account are kept by Supabase; the website and our server run on Vercel.
• AI reading happens in the United States, or other countries where Anthropic processes requests. WhatsApp messages pass through Meta's data centres.
• Where your data is kept, with every provider and country: see the privacy policy.

• Every page and request uses HTTPS, and our pages tell browsers to use nothing else (HSTS).
• Supabase, which holds the database and files, states that it encrypts data at rest with AES-256 and in transit with TLS.
• Vercel, which runs the website, states AES-256 at rest and HTTPS/TLS in transit.
• Meta states that the WhatsApp Cloud API uses industry-standard encryption in transit and at rest.

• A bill you file as Personal is seen by you alone; not even the household's owner sees it.
• A bill filed for the Home is seen by the household's adults. Members who join by invite start as senders, who see only their own bills.
• No member sees another member's email or full number, and nothing crosses households.
• People who run Masrouf reach your data only to answer your request, fix a fault, stop abuse, handle a security incident or meet a legal duty. Our admin page never shows a bill.

• An AI, Claude by Anthropic, reads what you send so it can file it. It asks when it is unsure, and you can correct anything it reads.
• Anthropic's terms forbid training its models on what we send, and we do not train on it either.
• Anthropic deletes requests and answers within 30 days; a request its safety systems flag can be kept up to 2 years, and its safety scores up to 7 years.
• Before a forwarded bank message or a typed line reaches the AI, we remove card numbers, bank account numbers (IBANs) and phone numbers written as phone numbers. A bank statement's pages go as they are.
• Voice notes are neither listened to nor transcribed.

• Sell your data.
• Show you ads, or use your data for advertising.
• Train AI on your bills, or let Anthropic train on them.
• Ask for your bank login, connect to your bank or move money.
• Use analytics, advertising or tracking cookies.

• Download everything. Settings → Privacy & data gives you one zip of your profile, bills, files and records.
• Delete. A bill from its menu on the website, or with Fix → Drop on WhatsApp. Leave the household or delete your account in Settings → Privacy & data; an owner can delete the whole household there.
• STOP. Send STOP on WhatsApp to turn off every message Masrouf sends first, and RESUME to turn them back on. Replies to what you send are not affected.
• Summaries off. Choose weekly, monthly or off in Settings, or send weekly off.
• Correct. Change any bill, your name or your settings yourself.

• Row-level security on every table, with no public access. The app reaches the database only through our server, which checks each request against who you are and what your role lets you see.
• Keyed hashes, not raw values. In our database, phone numbers, sign-in codes and internet addresses are kept as keyed hashes (HMAC); we never store your full number. Our sign-in provider keeps only a one-way hash of your password.
• Scrubbed logs. Our server is written to keep bill contents, amounts, message text, phone numbers and email addresses out of its logs.
• Limits and bot checks. Sign-in attempts, messages, reads and uploads are limited. A Cloudflare Turnstile check guards the email sign-up form and, where shown, the phone sign-in page. WhatsApp messages are accepted only with Meta's signature.
• Files checked. Uploads are typed by their content and capped in size and pages. Photos we can open are stored without their location, camera or time data.
• Retention purges. A daily job erases what has reached the end of its time: deleted bills after 24 hours, statement files 90 days after reading, and the rest as the privacy policy lists.
• Daily backups, kept 7 days. Files are not in them.

Masrouf Personal is built on providers certified to the standards below. These are each provider's own certifications, as its own page stated on 23 October 2026. They are not Masrouf's: Masrouf itself holds no certification, and has not yet had an independent audit or penetration test.

No system is perfectly secure. If a breach affects your data, we notify each regulator the law requires within its deadline (72 hours in Qatar, Saudi Arabia and the EU, for example), and tell you without undue delay what happened and what to do, whenever your law requires it. We record every breach in a register.

Supabase and Anthropic have agreed to tell us of a breach within 48 hours.

Found a weakness? Email expenses@masrouf.ai with "Security" in the subject. Please include:

• what you found, and where: the page, the address or the WhatsApp step;
• the steps to reproduce it;
• what it could expose or change;
• how to reach you.

In scope: masrouf.ai and my.masrouf.ai, and the WhatsApp numbers they use. Out of scope: our providers' own systems (report those to them), denial of service, spam, social engineering and physical access.

The rules. Test only with your own account. Stop as soon as you reach data that is not yours, tell us, and keep, change and share none of it. Do not disrupt the service. Give us 90 days, or until it is fixed if sooner, before you publish or tell anyone else.

Good faith. If you follow these rules in good faith, we will not take legal action against you for your research or report you to the authorities for it.

What we do. We confirm we have your report within 5 working days and tell you what we will do about it within 30 days. We tell you when it is fixed and, if you want, thank you by name. There is no paid bounty.

This is also in /.well-known/security.txt.