Security and Data Protection Policy

Haseef Legal Office Management System – Haseef

Effective Date: 01/01/2025 Version: 3.0 Last Updated: 29/07/2026

1. Introduction

1.1 This Security and Data Protection Policy ("the Policy") describes the administrative, technical, and organizational security measures implemented by Almaqar Information Technology Company ("Almaqar," "we") to protect the Haseef Legal Office Management System ("the Platform") and the infrastructure (as defined in the Terms of Use) on which it operates, and the data processed within the Platform.

1.2 This Policy supplements and must be read in conjunction with the Terms of Use and Privacy Policy, and all of them constitute an integral part of the licensing agreement concluded with the Customer and shall be read as a single document.

1.3 This Policy aims to provide Customers with an accurate and transparent understanding of the security measures that protect their Installations and data. Almaqar implements security measures based on standard industry best practices with commercially reasonable efforts, and continuously enhances its security posture. Nothing in this Policy constitutes a guarantee of absolute security outcomes or immunity from recurring global cyber risks.

2. Platform Architecture and Data Isolation

2.1 Single-Instance Architecture and Dedicated Application Instance per Customer

2.1.1 The Platform is provided as a cloud-hosted service for multiple independent law firms and legal organizations. Each Customer receives a dedicated application instance under a single-instance architecture, logically and programmatically isolated at the application and database level for each Customer; each dedicated Customer deployment includes:

(a) A dedicated and protected database instance, not shared with any other Customer;
(b) File storage space that is separate and logically isolated from all other Customer deployments;
(c) Independent application settings, independent environment variables, independent encryption keys, and dedicated session management;
(d) A logically isolated runtime environment operating on professionally managed cloud infrastructure;
(e) Independent backup, update, and maintenance processes performed per Customer deployment.

2.1.2 Customer databases are never shared or merged with each other; Customer data is never stored in shared databases. Each deployment's data is structurally and logically separate, and data cannot be queried, accessed, or shared across different Customer deployments through the application layer. No Customer can access another Customer's data through the Platform. Almaqar Information Technology Company manages the infrastructure, while each Customer retains full ownership of its own data.

2.2 Domain and Network Isolation

2.2.1 Each Installation is accessed and used through a dedicated domain or subdomain assigned to the Customer. Cookie scope is confined to the Installation's domain, and no cookie or session sharing occurs across different Installations.

2.2.2 Network-level and Domain Name System (DNS) controls and bindings ensure that traffic for each Installation is routed exclusively to the appropriate account, software repository, and dedicated database.

3. Infrastructure Security

3.1 Management of Leased Infrastructure

3.1.1 The infrastructure includes virtual private servers (VPS), networks, storage units, and foundational software upon which Installations are hosted, and which are leased, owned, or managed by Almaqar Information Technology Company through trusted global data centers. Almaqar retains full logical control and operational oversight over all components of this leased infrastructure.

3.1.2 Almaqar employs competent infrastructure operations personnel and engineers who possess appropriate training and authorizations, and all personnel with technical access to servers are subject to strict access control mechanisms and absolute confidentiality legal obligations.

3.2 Server Hardening

3.2.1 Almaqar implements strict standard server hardening practices, including:

(a) Removing or disabling unnecessary services, ports, and protocols;
(b) Applying operating system security updates and patches periodically;
(c) Restricting direct root access or control panels to essential authorized employees and engineers only and for maintenance purposes;
(d) Operating advanced network firewalls and antivirus software that immediately scan uploaded files, intrusion detection and prevention systems, and blocking malicious traffic.

3.3 System and Software Updates

3.3.1 Almaqar applies security patches and updates to server operating systems, web servers, database servers, PHP runtime environment, and all core components according to a regular periodic schedule.

3.3.2 Critical security patches and zero-day vulnerabilities are applied with operationally reasonable speed, which may require emergency maintenance windows that are implemented immediately and without prior notice to protect systems and Customer data from imminent threats.

4. Access Control Mechanisms

4.1 Role-Based Access Control for Company Engineers (RBAC)

4.1.1 Almaqar implements role-based blocking and control protocols to ensure that only its technical personnel access systems necessary for their functions and operational maintenance on a "least privilege" basis.

4.1.2 Almaqar employees or engineers are prohibited from browsing, copying, exporting, or retaining Customer data, and systems are only accessed when there is a documented and verified operational need.

4.2 Access Levels and Technical Support

4.2.1 Application-Level Access: For technical issues that arise within the Platform interfaces and application layer, the Customer is required to provide the support team with temporary access or create a restricted-privilege support account by the Administrator, with explicit written authorization. This access allows navigating the interface and directing error resolution without viewing the content of encrypted uploaded files.

4.2.2 Infrastructure-Level Access: For deep structural issues (such as server configurations, comprehensive upgrades, or file system and database maintenance), Almaqar engineers have the right to direct access to the leased infrastructure, servers, files, and database tables (via SSH, cPanel control panels, or phpMyAdmin tool). This access is governed by strict confidentiality legal obligations and access tracking controls.

4.2.3 Access Log Documentation: All access operations by company personnel for maintenance or technical support purposes are documented and recorded within the Platform's internal logs or general secure server logs (Server Logs).

4.3 Customer Application-Level Controls

4.3.1 The Customer (Administrator) has absolute and sole authority through the control panel to create and modify internal user accounts, assign roles (Administrator, Lawyer, Employee, Accountant), and define access and modification privileges for each according to the least privilege principle.

4.3.2 Almaqar does not intervene, manage, or possess any administrative or programmatic authority or oversight over the distribution and granting of these internal privileges and their protection, and the Customer alone bears the legal consequences of mismanaging privileges in their office.

5. Encryption and Technical Protection Scope

5.1 Encryption at Rest

5.1.1 The Platform applies encryption at rest technology on files and documents uploaded by the Customer as attachments (such as case documents, archive files, and court instruments). These files are fully encrypted using the Advanced Encryption Standard (AES-256) before being saved to the server's hard disk.

5.1.2 Database Non-Encryption: Structured and textual data entered through digital form fields (such as: client names, identity numbers, case details and dates, written notes, and invoice data) are stored in the Installation's dedicated database in direct text format (not programmatically encrypted at the application level), to enable search, sorting, and reporting features. This structured data is protected through database server security controls and infrastructure cyber hardening.

5.2 Encryption Key Management and Security

5.2.1 A unique encryption key is assigned to each Installation, and is securely stored and managed in a programmatically protected manner within the application's configuration and environment files dedicated to the Customer (.env file outside the public_html internet-accessible directory).

5.2.2 Almaqar undertakes to secure, store, and replicate configuration files and keys programmatically as part of the server's core system and general backup infrastructure, and no manual copy is provided to the Customer to prevent operational complications or data corruption in case of loss. Regeneration or modification of the key after file uploads begin is strictly prohibited to prevent permanent data corruption.

5.3 Customer Acknowledgment of Protection Scope

5.3.1 The Customer expressly agrees and acknowledges the following technical limitations:

(a) That AES-256 encryption is limited to uploaded files and documents, and does not extend to programmatic database tables;
(b) That the System automatically and transparently decrypts files upon request by an authorized user with application-level access, or by the support team to diagnose a technical issue at the Customer's request;
(c) That infrastructure engineers, by virtue of the nature of server and database management, possess the technical capability to access servers and view text tables via phpMyAdmin, and that this access is governed by strict confidentiality legal obligations and server log tracking controls;
(d) That the Customer's choice of data types entered and sensitivity of uploaded files constitutes the fundamental pillar of their data security.

6. Data in Transit

6.1 All communications and data flows between the user's browser and the Platform are fully encrypted and secured using the advanced Transport Layer Security protocol (SSL/TLS), and Almaqar is committed to providing and renewing these certificates for all Installations, domains, and addresses.

6.2 Internal communications between infrastructure components (between the web server and database engine) are fully protected and confined by internal control mechanisms at the operating system level and locally isolated network.

7. Network Security

7.1 Almaqar implements strict network security measures including:

(a) Firewalls to control traffic and restrict access to server control panels only from specific and trusted IP addresses;
(b) Intrusion detection and prevention systems to identify and block suspicious or malicious traffic;
(c) Distributed Denial of Service (DDoS) protection measures to protect the Platform from volumetric attacks;
(d) Isolation of user accounts and repositories at the server operating system level to prevent account interference;
(e) Rate limiting to block password guessing attempts or abuse.

8. Backup and Disaster Recovery

8.1 Infrastructure Backup Policy and Timelines

8.1.1 Almaqar conducts periodic and automatic backup operations of all databases, static files, and configuration files (including environment files and embedded keys), and is committed to retaining these backups on the server for five (5) consecutive days only for general emergency purposes and recovery from technical disasters and hardware damage.

8.1.2 Backups lose their effectiveness and are automatically deleted outside the five consecutive day period, and Almaqar bears no legal or technical responsibility for restoring or retrieving any files or data that the Customer or its users have deleted mistakenly or intentionally outside this time period.

8.2 Customer Security Responsibilities and Local Backup

8.2.1 The Platform provides the Customer (Administrator) with data and file export and withdrawal tools at any time. The Customer alone bears the administrative responsibility for executing periodic local backup operations and retaining them on their devices or private cloud as an additional defense layer and maximum protection for their business and clients.

8.3 Disaster Recovery Plan

8.3.1 Almaqar maintains a technical emergency plan for restoring infrastructure and Customer Installations from available backups in the event of a catastrophic server failure beyond its control. The Company does not provide guarantees for specific recovery time objectives (RTO) or a specific recovery point objective (RPO), but exerts maximum technical efforts with the VPS service provider to restore normal operations as quickly as possible.

9. Security Monitoring and Incident Response

9.1 Almaqar continuously monitors the infrastructure for security events, unauthorized access attempts, malware detection, and unusual system behavior, and takes immediate action to mitigate threats.

9.2 The Company maintains a cyber incident response plan to address and contain any security breach. In the event of a confirmed security incident that has been proven to constitute a personal data breach (Data Breach) affecting Customer data, Almaqar is committed to notifying the affected Customer without undue delay and assisting with the basic information available to comply with their legal obligations. This notification does not constitute an admission of liability or negligence but rather a commitment to transparency and cooperative action.

10. Vulnerability Management and Application Security

10.1 Almaqar monitors known vulnerabilities in the software components used to build the Platform (such as the Laravel framework, PHP runtime, and MySQL database), and is committed to periodically patching critical software vulnerabilities (in accordance with the OWASP Top Ten most critical standards).

10.2 The "Haseef" system is developed and updated in accordance with secure coding practices to protect inputs, prevent injection attacks (SQL Injection), protect against Cross-Site Scripting (XSS), provide mandatory Two-Factor Authentication (2FA), and hash and encrypt passwords using industry-standard complex cryptographic algorithms.

11. Customer Security Responsibilities

Based on the principle of shared security responsibility, the Customer bears full and sole responsibility for the following:

(a) Protecting credential data and password confidentiality, and enforcing mandatory Two-Factor Authentication (2FA) for all employees without exception;
(b) Managing access permissions for employees and trainees and canceling and revoking their accounts immediately upon termination of their relationship with the office;
(c) Reviewing and verifying the integrity and quality of any optional integration with third-party services (such as Google Drive or WhatsApp Business notification linking), as those companies and their policies fall outside the scope of Almaqar's control and protection;
(d) Securing local networks and mobile devices used by lawyers to access the Platform and continuously updating their browsers and combating viruses on their devices.

12. Data Processing Summary Table

The following table summarizes the governing rules for the security architecture and processing applied in the Haseef system:

Aspect and Technical Mechanism	Governing Description and Contractual Obligation
Infrastructure Architecture	Single-instance architecture. Dedicated application instance and database per Customer on professionally managed cloud infrastructure operated through (cPanel).
Independent Data Controller	The Customer (law office) is solely responsible for the legitimacy and validity of processing their clients' data.
Technical Data Processor	Almaqar Company (executing hosting, security updates, technical support, and routine backups).
Encryption at Rest	Standard (AES-256) for uploaded files and documents as attachments only, and does not extend to textual database tables.
Encryption in Transit	Protocol (SSL/TLS) for all communications and browsing over the Internet.
Digital Encryption Key	Unique per Installation, stored programmatically in the server-protected environment and configuration files, managed by the Company automatically without manual delivery.
Technical Support and Access	Application access via a temporary support account upon Customer request, and infrastructure access via (SSH/phpMyAdmin) for authorized engineers under confidentiality obligations.
Purposes of Data Access	Strictly limited to providing services and system maintenance. Advertising, marketing, behavioral analysis, or resale are strictly prohibited.
Server Backup	Automatic system retaining backups on the server for only (5) consecutive days for general emergency purposes.
Data Retention and Deletion	The Installation is deleted and all its databases and files are completely and irreversibly technically destroyed within a maximum period of (30) days from the date of actual cancellation or termination of the subscription, and invoice and licensing records are retained for 5 years as required by applicable financial regulations.

13. Compliance and Governing Law

13.1 This Policy is governed by, interpreted, and applied in accordance with the laws and legislation in force in the State of Libya (including Communications Law No. 12 of 2010, and Electronic Transactions Law No. 6 of 2022). In the event of any dispute that cannot be resolved amicably within thirty (30) days, it shall be exclusively referred to the jurisdiction of the competent courts in the city of Tripoli, State of Libya.