Security & compliance
Tested on the live system, not just described.
How does Amoura keep distribution data secure?
An external penetration test of the live app found no critical or high issues. A load test ran 150 reps at once with no server errors. The database is backed up every hour and one backup is restored and checked every night. Users sign in with two-factor codes or a passkey, every action is checked against their role, every record is scoped to its company, and approvals and financial actions go into an audit log.
What we measured
An external penetration test of the live app in October 2026 found no critical or high issues. The two medium and one low finding were fixed and checked again on the live system the same day.
A load test ran 150 reps working at the same time on the live system: 42,504 requests, no server errors.
The database is backed up every hour from 6am to 11pm UAE time, encrypted with AES-256. Every night one backup is restored into a clean database and checked against the live one.
An outside service checks the app every 5 minutes and alerts us if it stops answering. Server errors are reported to us automatically.
How it is built
Role-based access
Every action, approval and financial change is checked against the user's role.
Two-factor sign-in
Authenticator-app codes (TOTP) and passkeys. A device can be trusted for 30 days so people aren't asked every time.
Sessions end on sign-out
Signing out ends the session on the server too, so a copied browser session stops working.
Audit log
Approvals, price changes and financial actions are logged with who, what and when. Admins can filter the log and export it.
Company data kept apart
Every record belongs to one company and every query is scoped to it, so one company never sees another's data.
Rate limiting
Sign-in and other sensitive requests are rate-limited to slow down abuse.
Audited infrastructure
Amoura runs on Vercel and Supabase, whose infrastructure is audited for SOC 2 Type 2 and ISO 27001. Data may be processed outside the UAE.
Dual sign-off on orders
Orders need manager and warehouse approval, and high-value orders also need the CEO or GM.
Expiry and licence tracking
Batch expiry is tracked on a compliance screen. Licences, permits, contracts and insurance are stored with expiry dates and marked as expiring 30 days ahead.
We list only what’s real, so you won’t see certifications here that Amoura doesn’t hold. For a security questionnaire or the full test summary, write to hello@amoura.ae.
Security questions
Has Amoura been tested by someone outside the team?+
Yes. An external penetration test of the live app in October 2026 found no critical or high issues. The two medium and one low finding were fixed and checked again the same day. We also load tested the live system with 150 reps working at once: 42,504 requests and no server errors.
What happens if something goes wrong with the data?+
The database is backed up every hour from 6am to 11pm UAE time, encrypted with AES-256. Every night one backup is restored into a clean database and checked, so we know the backups actually work.
How does Amoura control who can see and change data?+
Access is role-based. Every action, approval and financial change is checked against the user's role, and each role has its own pages and permissions. Every record belongs to one company and every query is scoped to it, so one company never sees another's data.
Does Amoura support two-factor sign-in?+
Yes. Users sign in with authenticator-app codes (TOTP) or a passkey. A device can be trusted for 30 days so people are not asked every time.
Where is the data hosted?+
Amoura runs on Vercel and Supabase, whose infrastructure is audited for SOC 2 Type 2 and ISO 27001. Data may be processed outside the UAE.
Is there an audit log?+
Yes. Approvals, price changes and financial actions are logged with who, what and when. Admins can filter the log and export it.
Ready when you are
See how your data is handled.
Book a 30-minute demo and we’ll walk your real workflow (orders, approvals, inventory, finance) on the system, not a slide deck.