- Home
- Security
Security is in the foundations
Your leases, retailers' sales and visitors' details are some of the most sensitive data a landlord holds. This is how we protect them in Mercato.
Isolation in the database
Every company-owned table carries PostgreSQL row-level security. The application connects with a role that cannot bypass it, so one company's records are invisible to another even if a query goes wrong.
Dedicated deployment
Mercato runs as its own deployment with its own database and file storage. In-region hosting is available for customers with data-residency requirements.
Encryption
All traffic is encrypted with TLS. Documents are stored with server-side encryption, and secrets such as integration credentials, e-invoicing keys and visitor identities are encrypted again by the application.
Strong sign-in
Authenticator-app two-factor codes with backup codes, passkeys, and single sign-on with your identity provider through OpenID Connect. Companies can require MFA for every user.
Session and password policy
Passwords of at least 12 characters, lockout after repeated failures, and per-company idle timeout, concurrent-session limits, password history and expiry.
Least-privilege access
Ready-made roles for each mall job, granular permissions, property-level access so users see only their centres, and a separate permission for seeing amounts.
Audit trail
Sensitive actions are recorded with who, what and when: exports, erasures, visitor-card views, API-key changes, kiosk links and e-invoice submissions.
Backups
Automated, scheduled database backups with off-site copies in separate object storage, kept under a retention policy and restorable by our operations team.
Application safeguards
Rate limits on sign-in, the API and downloads, API keys with per-key scopes, and an AI assistant that is read-only and sees only what the user may see.
Privacy
Built to help you meet data-protection law
You are the controller of your retailers' and visitors' data; we process it on your behalf under a data processing agreement aligned with the UAE Personal Data Protection Law.
Read the DPA- Consent on record for every visitor profile, with the version of the text they agreed to.
- Export and erasure for a data subject on request, each one audited.
- Retention limits: visitor data is anonymised automatically after 24 months by default.
- No device tracking: guest Wi-Fi sign-in never stores device MAC addresses.
- Kiosks show no lease data: information-desk screens show directory and routes only.
Responsible disclosure
Found a vulnerability?
Please e-mail info@reosoft.ai with the subject "Security report", a description and the steps to reproduce. We will acknowledge within two business days and keep you informed until it is fixed. Please do not access other customers' data, degrade the service or disclose the issue publicly before we have fixed it. Our contact details are also published in security.txt.
Running a security review?
We can walk your IT and compliance team through our architecture, controls and data-processing terms.