Security and data hosting

Plain answers on where your data lives, who processes it and what stays in your control. Only facts we can stand behind.

Primary systems hosted in the EU

The app, database and logs run on Contabo servers in the EU, behind Cloudflare.
Knowledge files and encrypted off-site backups are on Cloudflare R2 in the EU.
OpenAI (US) processes message text and voice-note audio so the assistant can reply.
WhatsApp messages travel through Meta's WhatsApp Business Platform, on your own account.
Sabbaq is operated and supported from Lahore, Pakistan.
We don't host data in the UAE, and we don't say we do.

Full list of sub-processors

Backups, incidents and reporting

Daily backups are encrypted and copied off-site to EU storage, retained for 30 days; restores are tested.

If a personal data breach affects your data, we'll notify you without undue delay and in any case within 72 hours of becoming aware of it.

Found a vulnerability? Email [email protected].

Encryption and access

Access-controlled infrastructure in the EU; secrets encrypted with AES-256; encryption in transit (TLS).
Secrets, such as WhatsApp access tokens, are encrypted with AES-256.
Each brokerage's data is logically separated by workspace and enforced on every request.
Three roles: agents work the inbox; admins also manage settings, team and listings; owners also run billing and WhatsApp.
Staff access is logged: admin actions, views of personal data with a stated reason, and logins.

Your number and your data stay yours

Your WhatsApp number stays in your Meta account.
Revoke access from Meta at any time; Sabbaq stops sending immediately.
Export lead and consent CSVs yourself; full exports go through us.
To delete your data, email [email protected]; our staff do it.
Our marketing site sets no cookies before you consent.
Buyers who send STOP or «إيقاف» are opted out automatically.

Guardrails in code, not in a prompt

Hard rules hand the chat to an agent for price talks, legal questions (SPA, title deed, POA), mortgage advice, viewing confirmation, ID or card numbers, or a buyer typing AGENT. Facts must match your listings (prices within 2%). It says it's an AI first.

OpenAI processes message data under its default API terms: it isn't used to train models and is kept up to 30 days for abuse monitoring.

What we do, and what we never do

We do

Run on your own WhatsApp Business account
Keep your existing number in your Meta account
Host our primary systems in the EU
Encrypt data in transit
Put guardrails in code, not in a prompt
Say it's an assistant, and hand over when asked
Let you export lead and consent data as CSV

We never

Automate a personal WhatsApp account
Put your brokerage on a shared number
Negotiate price with a buyer
Give legal or mortgage advice
Confirm a viewing without an agent

What we don't claim

No security certifications such as SOC 2 or ISO 27001 yet
No hosting in the UAE
No partnership with Meta, Property Finder or Bayut

Questions about your data?

Ask us on the 15-minute demo, or email [email protected].

Start free trial Book a 15-min demo