Security

Last updated: September 21, 2026

How we protect your account and data on the Darak API and developer platform. For a security questionnaire, or to report a vulnerability, contact us.

API keys

Hashed at rest. We store only a SHA-256 hash of each key. The full key is shown once, when it's created, and can't be recovered.
Recognizable. Keys start with dk_live_ (data) or dk_admin_ (admin API), so they're easy to catch with secret scanning.
Least privilege. A key can be limited to some APIs, given an expiry date, placed in a project with a monthly cap, and restricted to an IP allowlist for your organization.
Rotation without downtime. Rotating a key issues a new one and keeps the old one working for a grace period you choose.
Never in URLs. Keys sent as a query parameter are rejected, because URLs end up in logs.

Accounts and access

No passwords. You sign in with Google or a one-time email link.
Recent sign-in for sensitive actions. Creating or rotating a key, and deleting an organization, need a sign-in from the last 15 minutes.
Roles. Owners, admins and members, with only owners able to create admin keys, change retention and the IP allowlist, or delete the organization.
Invitations are accepted only by the invited email address.
Notifications. Owners and admins get an email when a key is created or revoked, or is about to expire.

Audit and visibility

Audit log of security-relevant changes (keys, members, settings), with who made them, when and from which IP. Changes made through the admin API are attributed to the admin key.
Request logs with a request ID on every response, searchable in the dashboard.
Status page at platform.darak.app/status, with synthetic checks every 5 minutes and incident history.

Data protection

Encryption in transit (TLS 1.2+) and at rest (database storage encrypted by our provider).
Retention you control. Request logs are deleted after 7, 30 or 90 days, your choice, and you can turn off storage of request parameters, IP addresses and user agents entirely.
Isolation. Every query in the dashboard and API is scoped to your organization's account.
Subprocessors are listed at platform.darak.app/legal/subprocessors.

Personal data and the PDPL

Saudi Arabia's Personal Data Protection Law applies to us and, separately, to you.

What's in the data you receive. Standard listing endpoints are built to leave out advertiser names, phone numbers and commercial registration numbers. What remains is the ad: text and images an advertiser wrote and published, which can still contain personal data they chose to include. Treat listing text and photos as potentially personal, not as clean fields.
Your role and ours. For the data you pull and store, you are an independent controller — not our processor, and not covered by our compliance. The Personal Data Protection Law and its implementing regulations apply to you directly, along with whatever else applies where you operate. Section 8 of the API terms sets out what that means in practice, including the 30-day storage limit and the takedown obligations that make it workable.
Data we hold about you. Your account, your organization's members, your API keys and your request logs. Request logs are the only place your API usage is recorded; you choose how long they're kept and whether they include parameters, IP addresses and user agents at all.
Where it's processed. Our infrastructure providers are listed under subprocessors, with what each one handles. Some operate outside the Kingdom.
Deletion. Deleting an organization revokes its keys and detaches its client. Ask us and we'll delete the account data behind it.

We don't publish a data processing addendum yet. If your procurement needs one, or needs the cross-border transfer position for a specific subprocessor in writing, write to us and we'll work through it with you rather than point you at a page that doesn't answer the question.

Our operations

Production access is limited to the people who run the service, and changes go through code review and automated tests.
Rate limits, monthly quotas and paging-depth limits protect the service from abuse.
Incidents are investigated and posted on the status page, and we notify affected customers of any breach of their data without undue delay.

Certifications

We don't hold SOC 2 or ISO 27001 certification yet. We're happy to answer your security questionnaire in the meantime.

API keys

Hashed at rest. We store only a SHA-256 hash of each key. The full key is shown once, when it's created, and can't be recovered.

Recognizable. Keys start with dk_live_ (data) or dk_admin_ (admin API), so they're easy to catch with secret scanning.

Least privilege. A key can be limited to some APIs, given an expiry date, placed in a project with a monthly cap, and restricted to an IP allowlist for your organization.

Rotation without downtime. Rotating a key issues a new one and keeps the old one working for a grace period you choose.

Never in URLs. Keys sent as a query parameter are rejected, because URLs end up in logs.

Accounts and access

No passwords. You sign in with Google or a one-time email link.

Recent sign-in for sensitive actions. Creating or rotating a key, and deleting an organization, need a sign-in from the last 15 minutes.

Roles. Owners, admins and members, with only owners able to create admin keys, change retention and the IP allowlist, or delete the organization.

Invitations are accepted only by the invited email address.

Notifications. Owners and admins get an email when a key is created or revoked, or is about to expire.

Audit and visibility

Audit log of security-relevant changes (keys, members, settings), with who made them, when and from which IP. Changes made through the admin API are attributed to the admin key.

Request logs with a request ID on every response, searchable in the dashboard.

Status page at platform.darak.app/status, with synthetic checks every 5 minutes and incident history.

Data protection

Encryption in transit (TLS 1.2+) and at rest (database storage encrypted by our provider).

Retention you control. Request logs are deleted after 7, 30 or 90 days, your choice, and you can turn off storage of request parameters, IP addresses and user agents entirely.

Isolation. Every query in the dashboard and API is scoped to your organization's account.

Subprocessors are listed at platform.darak.app/legal/subprocessors.

Personal data and the PDPL

Saudi Arabia's Personal Data Protection Law applies to us and, separately, to you.

What's in the data you receive. Standard listing endpoints are built to leave out advertiser names, phone numbers and commercial registration numbers. What remains is the ad: text and images an advertiser wrote and published, which can still contain personal data they chose to include. Treat listing text and photos as potentially personal, not as clean fields.

Your role and ours. For the data you pull and store, you are an independent controller — not our processor, and not covered by our compliance. The Personal Data Protection Law and its implementing regulations apply to you directly, along with whatever else applies where you operate. Section 8 of the API terms sets out what that means in practice, including the 30-day storage limit and the takedown obligations that make it workable.

Data we hold about you. Your account, your organization's members, your API keys and your request logs. Request logs are the only place your API usage is recorded; you choose how long they're kept and whether they include parameters, IP addresses and user agents at all.

Where it's processed. Our infrastructure providers are listed under subprocessors, with what each one handles. Some operate outside the Kingdom.

Deletion. Deleting an organization revokes its keys and detaches its client. Ask us and we'll delete the account data behind it.

Our operations

Production access is limited to the people who run the service, and changes go through code review and automated tests.

Rate limits, monthly quotas and paging-depth limits protect the service from abuse.

Incidents are investigated and posted on the status page, and we notify affected customers of any breach of their data without undue delay.