MSE-123 · Edition 1.0 · October 2026
Trust Centre
How we approach security, privacy, artificial intelligence, accessibility and compliance, and where each practice stands today.
MominSheikh.com is in development and not yet generally available.
Our practices are written down in policies and designs, parts of the platform are built, and we are preparing for launch. We will not accept customer data until the protections that launch requires are in place and an independent security test has been completed with its serious findings fixed.
How to read the status labels
Each practice on this page carries one of these labels.
| Label | Meaning |
|---|---|
| In place | Operating today, with evidence available |
| Documented | Set out in an approved policy or procedure |
| Being built | Designed and partly built; not yet operating |
| Planned | Scheduled for a later stage |
| Not held | Not held at present |
If a practice that matters to you is “Being built” or “Planned”, ask us when it is expected and whether it can be a condition of your agreement. We would rather agree that clearly than overstate where we are.
Security
| Practice | What it means | Status |
|---|---|---|
| Security policy and ownership | An approved information security policy, a named accountable owner and a risk register reviewed monthly | Documented |
| Multi-factor authentication | Required for administrators and anyone with production access, with phishing-resistant methods for privileged access; available to all users | Being built |
| Least-privilege access | Access refused unless explicitly allowed; permissions checked on the server for every request | Being built |
| Separation between customers | Each organisation's data kept apart, with isolation tested before releases | Being built |
| Encryption | Data encrypted in transit and at rest, with keys managed by purpose | Being built |
| Secure development | Threat modelling, secure coding rules, reviewed changes, automated security scanning and signed releases | Documented |
| Independent security testing | An independent penetration test before launch and every year after | Planned |
| Vulnerability fixing | Set deadlines for fixing weaknesses by severity | Documented |
| Backups | Encrypted, isolated, immutable backups proven by restore tests | Being built |
| Monitoring and audit | An immutable audit trail of security-relevant actions, which you can view for your organisation | Being built |
Our staff and your data
Our staff have no standing access to your data. If support needs to look at something in your organisation, you opt in, or a legal or security need is recorded; access is limited in time, read-only by default, visible to you and recorded in your audit log.
Certifications
We do not hold ISO 27001, SOC 2 or other security certifications at present. Not held Our practices are designed with reference to recognised frameworks. If we decide to pursue a certification, we will say so here, and we will not describe ourselves as certified until we are.
Privacy
We collect only the personal data we need, use it for the purposes we state, keep it only as long as needed and protect it to the standard of the strictest market we serve. Our privacy notice explains this; the full privacy policy is to be published before launch.
| Market | Law | Our approach |
|---|---|---|
| Portugal and the EU | General Data Protection Regulation | EU customer data hosted in the EU by default; data subject rights supported; authority notified within 72 hours of a qualifying breach |
| Oman | Personal Data Protection Law | Arabic privacy notices before collection; explicit consent where required; breach register; notification within 72 hours where required |
| Pakistan | No general data protection law in force | The same protections, risk tests and notifications applied by policy |
Your rights
Depending on where you are, you may have rights to access, correct, export, restrict or delete your personal data, and to object to some uses. You can exercise them through your account settings once available, or by contacting us (privacy contact to be confirmed).
Business customers
When you use MominSheikh.com to manage your own clients' data, you decide how it is used and we process it on your behalf. We offer a data processing agreement, tell you about new sub-processors in advance, help you meet your own obligations and support export and deletion at the end of your contract.
Marketing and cookies
We send marketing only with your consent, and every marketing message has a one-step unsubscribe. Non-essential cookies are set only with your consent, and the website works fully if you decline them. You can change your consent at any time; see the cookie policy.
Artificial intelligence
MominSheikh.com includes AI features, under the name Momin Intelligence, and a knowledge assistant called Ask Momin. These are planned for later stages of the platform. The principles below already govern how they are being designed.
- 1. AI is labelled. You are told when you are interacting with AI, and AI-generated content is labelled.
- 2. AI works within your permissions. AI features can see and do only what you are allowed to see and do.
- 3. People approve important actions. Sending messages, moving money, deleting records and sharing confidential documents require your confirmation.
- 4. Sources are shown. Ask Momin shows the sources it relies on and says when it is unsure.
- 5. No pretending. Ask Momin never presents itself as Momin Sheikh.
- 6. Your data stays yours. Your data is not used to train AI models without your explicit agreement.
- 7. You stay in control. Organisations can turn AI features off.
We will list the AI providers we use, and how they handle data, alongside our other sub-processors when providers are chosen. If an AI answer looks wrong, tell us. See also responsible AI.
Accessibility
We design MominSheikh.com to meet the Web Content Accessibility Guidelines (WCAG) 2.2 at level AA in both light and dark themes, and we check consumer flows offered in the European Union against the European standard EN 301 549. The platform is designed for English, Urdu, Arabic and Portuguese, including right-to-left layouts for Urdu and Arabic. Which languages are complete at launch will be announced before launch.
Accessibility is designed into our components and checked in our testing plans; it will be verified on the platform before launch. If anything stops you using MominSheikh.com, tell us: accessibility problems are treated as defects, not suggestions. See the accessibility page.
Reliability and incidents
We plan for failure: services are monitored, backups are tested by restoring them, and recovery objectives are set for each service. A public status page will report incidents that affect customers; it is to be published at launch.
We have a documented incident response plan. If an incident affects your data, we will tell you without undue delay with what we know, what we are doing and what you should do, and we will update you as facts emerge. Where the law requires us to notify a regulator or affected people, we do so within the legal deadline.
Reporting a vulnerability
If you believe you have found a security weakness, please tell us privately.
| Step | Our commitment |
|---|---|
| Acknowledgement | Within three working days |
| Assessment | Within ten working days, with the severity we assign |
| Updates | At least every thirty days until fixed |
| Disclosure | Coordinated with you, normally after the fix |
| Thanks | Public credit if you would like it |
We do not run a paid bug bounty at present. Please do not test against other people's accounts or data: create your own test account, and tell us what you found.
Suppliers and documents
We assess suppliers before we use them. Suppliers that process personal data sign data processing terms and are listed as sub-processors, with what they do and where.
| Document | Availability |
|---|---|
| Privacy policy | Published before launch |
| Terms of service | Published before launch |
| Data processing agreement | On request |
| Security questionnaire responses | On request |
| Security policy summaries | On request |
| Independent penetration test summary | After the first test, under a confidentiality agreement |
| Accessibility statement | Published at launch |
| Sub-processor list | Published before launch |
Ask for what you need. If a document you need is not on this list, we will tell you whether we can provide it.
Updates and contact
We update this page whenever a practice changes status, when a policy changes and at least every quarter.
| Date | Change |
|---|---|
| October 2026 | First edition published |