Security
This page is written to be forwarded. It says what is true today, and it says plainly which questions we have not finished answering — because a vague answer reads as a yes, and then it is a commitment nobody made.
Each of these is something you could verify in a technical session rather than take on trust.
Isolation at the database row
Every company’s data is separated by the database itself rather than by a filter in the application. The distinction matters: an application filter is one missing WHERE clause away from a cross-tenant read, and a row-level policy is not.
A queryable audit log
Every view of a salary figure, every approval, every change to an employment record is written to a log with the actor, the time and what changed. It is queryable rather than archived, because an audit trail nobody can search is a compliance artefact rather than a control.
Managers see cost, not pay
By default a line manager sees team cost against budget and never an individual salary. Visibility is a permission scope you set, not a screen someone remembered to hide.
The browser never holds a token
Session tokens live in httpOnly cookies and every API call is made server-side. There is no access token in local storage for a browser extension or a cross-site script to read.
Roles and approval scopes
Permissions are scoped by entity, branch and cost centre. A branch manager’s view is a boundary the server enforces, not a filter the client applies.
Encrypted in transit
All traffic to Dawmo is over TLS, including the bridge agent that reads your on-site biometric readers.
Publishing these is uncomfortable and it is the right call. A procurement team would rather have a dated open question than a confident sentence that turns out to be marketing.
Data residency
Being decidedWhether UAE residency is the default for every customer or an enterprise option is a decision we are settling now. We would rather say that than imply an answer you would later hold us to.
PDPL position
With legalOur written position under the UAE data protection law is with legal. It will be published here in full, with the DPA alongside it.
Certifications
Not heldWe do not hold ISO 27001 or SOC 2 today, and we are not going to imply otherwise on a page procurement reads. When we hold one it will be named here with its date and scope.
A group or an entity with an IT veto usually wants these before the first meeting rather than after it.
Ask for any of it — no meeting required to receive a document.
We would rather answer it before the demo than discover in week six that a control you needed is one of the three we have not settled.