On the record
Security & data protection
Hawaij holds registers of people receiving assistance in a conflict. That is the most sensitive data there is, and this page says — plainly, and on the record — how it is protected, where it lives, and what we will never do with it.
How the register is protected
Encrypted, at rest and in transit
Identifiers, answers and account numbers are encrypted in the database; every connection runs over TLS. A copied disk is ciphertext.
Two-step sign-in
Any account can require an authenticator code alongside its password. Admin accounts should.
Every look is on the record
Viewing, editing, exporting or printing a beneficiary record lands in an audit trail the organization itself can read — insider misuse has nowhere quiet to happen.
Least data by design
QR cards carry a reference number and a signature — never a name. The field app caches no register. Forms that ask for ethnicity, religion or exact coordinates get a warning before they exist.
Consent and the person's rights
Consent is recorded with a timestamp and the exact words read out. A person can ask to see, correct, or erase their data — and a granted erasure actually erases, while the financial audit trail stays intact.
Your data leaves with you
One click exports the whole tenancy as plain CSV files, schema documented. Closing the account erases everything and hands you a deletion certificate. Lock-in is answered with a door, not a promise.
What we will never do
No secondary use, ever
Beneficiary data is processed only on the organization's instructions. It is never sold, never used for analytics products, never used to train AI models.
No beneficiary vetting
Hawaij does not and will not screen aid recipients against sanctions or watch lists. Humanitarian assistance is delivered by need.
No biometrics
No fingerprints, no iris scans, no face databases. In a conflict, the safest field is the one that never existed.
Where the data lives
Hawaij runs on Tarout, a cloud platform in the Kingdom of Saudi Arabia (region me-central2), under the Kingdom's enforced Personal Data Protection Law (PDPL). Sub-processor list: Tarout (application hosting, database, file storage — Saudi Arabia). We will notify customers before any change to this list. An EU hosting region can be arranged for organizations whose funding requires it.
Demands from authorities
If any authority demands access to an organization's register, our policy is: verify the demand is legally binding, narrow it to the minimum, notify the organization immediately unless the law forbids it, and challenge overbroad requests. Because data is encrypted and minimal, what exists to be handed over is as little as we can make it.
If something goes wrong
If a breach touches your data, we notify you within 72 hours of confirming it, with what was affected and what we are doing — and we help you notify the people concerned, as humanitarian data-responsibility guidance requires.
The agreement behind this page
Every organization gets a data-processing agreement covering all of the above, accepted in-app and versioned. Questions, or a due-diligence questionnaire to fill? Write to contact@hawaij-sd.com — answering these is part of the product.