Security4 min read
Where does your data live?
You are trusting a business management application with your sales, your customers and your cash. This article explains where that data sits and how it is protected, without overstating anything.
Every business sees only its own data
The data sits in a shared database, but businesses cannot see each other’s records. The separation is enforced in the database itself, not in the application layer: every table carries a row-level security rule, and the rule applies even to an administrator account.
In practice this means that even if the application has a bug, the database will not return another business’s row.
Records are never deleted
No delete permission is defined on the record tables. An entry is marked as "cancelled" or "corrected"; its history is not lost. Audit records cannot be changed at all — they can neither be updated afterwards nor deleted.
This is what makes it possible to show who did what and when if a dispute arises.
Permissions belong to roles, not to people
What someone can see is defined against roles, not against individuals one by one. When a member of staff leaves, their access is removed in one place; no forgotten permission is left behind.
In Qatibo Business those permissions apply to the screens themselves: a user without permission cannot open the screen at all, and no page is left "hidden but reachable".
If you have a question
The full data processing terms are written on the Privacy Policy and Terms of Use pages. If you cannot find your answer there, write to us and we will give you the technical answer.