Data Security – booktact

+971581588997

inquiry@booktact.com

Data Security Framework for out business and client

At BookTact your data is secured like a vault. Protecting financial data is non-negotiable. As per UAE government breaches lead to fines (up to AED 1.5M under UAE PDPL), loss of trust, and legal action, so we Implement this 7-layer security model to safeguard client data.

1. Legal & Compliance Foundation

Requirement	Action Steps
UAE Personal Data Protection Law (PDPL)	Appoint DPO, conduct DPIA, get client consent
NESA / TDRA Standards	Comply with UAE Information Assurance Standards
VAT & Tax Compliance	Secure TRA portal access (2FA + IP whitelisting)
Client Contracts	Include NDA + Data Processing Agreement (DPA)

2. Secure Technology Stack

Tool	Recommendation
Accounting Software	Xero, QuickBooks Online, Zoho Books (cloud with AES-256 encryption)
Cloud Storage	Google Workspace / Microsoft 365 (Business Premium) – with DLP
Backup	Automated encrypted backups (Veeam, Acronis) – 3-2-1 rule
VPN	NordLayer / Cisco AnyConnect for remote access
Endpoint Protection	Bitdefender GravityZone / CrowdStrike

3. Access Control & Authentication

Zero Trust Model: Verify every user, device, session
Multi-Factor Authentication (MFA): Mandatory on email, software, VPN
Role-Based Access Control (RBAC):
- Bookkeeper → View only
- Accountant → Edit + export
- Admin → Full access
Password Manager: 1Password / LastPass Teams
Session Timeout: Auto-lock after 10 mins of inactivity

4. Data Encryption (At Rest & In Transit)

Layer	Standard
In Transit	TLS 1.3 (HTTPS, SFTP)
At Rest	AES-256 (disk + database)
Email	S/MIME or PGP for sensitive attachments
Client Portals	End-to-end encrypted (e.g., ClientHub, Karbon)

5. Physical & Operational Security

Office Access: Biometric + CCTV + visitor log
Device Policy:
- Company-owned laptops only
- Full-disk encryption (BitLocker/FileVault)
- Remote wipe capability
Paper Records: Locked cabinets + shredding policy
Clean Desk Policy: No financial docs left unattended

6. Employee Training & Culture

Mandatory Annual Training: Phishing, PDPL, secure file sharing
Phishing Simulations: Use KnowBe4 or Proofpoint
Incident Reporting: 24-hr reporting window
Background Checks: For all staff handling data

7. Incident Response & Recovery

Step	Action
Detect	SIEM tool (e.g., Microsoft Sentinel)
Contain	Isolate affected systems
Eradicate	Remove malware, patch vulnerabilities
Recover	Restore from clean backup
Report	Notify clients + TDRA within 72 hours (if PDPL breach)
Review	Post-incident root cause analysis

Dubai-Specific Security Add-Ons (Client Value Proposition)

Service	Benefit
UAE-Based Data Centers	Compliance with data residency (use AWS Dubai, Azure UAE)
Arabic + English Support	Serve local & expat clients
Free Zone Compliance	IFZA, DMCC-approved secure workflows
Crypto Bookkeeping Security	Cold wallet integration + KYC/AML logs