Hesabi security model: data residency and access

Hesabi stores invoices, customer tax IDs, bank reconciliation lines, and TTN clearance metadata for Tunisian PMEs. Security is not a marketing slide—it is encryption on the wire and on disk, hosting in an EU OVH region, role-based access that separates owners from accountants, tested backups, and a subprocessor list you can hand to a procurement team. This guide explains what DarDev operates today and what we document when a buyer asks hard questions.

We write from production operations on dardev-vps, not from a generic SaaS checklist. Legal interpretation of Tunisian data rules remains your counsel's job; this article covers technical and operational controls you can verify during onboarding or due diligence.

Encryption in transit and at rest

All customer-facing Hesabi endpoints are served over HTTPS with TLS terminated at the host reverse proxy. Browser sessions, API calls, and webhook callbacks between Hesabi and integrated services use encrypted channels—plain HTTP is not exposed on public interfaces.

At rest, application databases run on PostgreSQL volumes with provider-level disk encryption on the OVH VPS. Application secrets—database passwords, signing keys, integration tokens—live in environment configuration injected at deploy time, not in source repositories. Operator laptops do not hold production database dumps by default; exports are generated on demand through authenticated Hesabi sessions.

• TLS on hesabi.tn and related admin surfaces
• Encrypted volume storage for Postgres and file attachments
• Secrets managed outside git; rotation documented in internal runbooks
• No shared owner password policy—individual accounts with role scopes

Where Hesabi data is hosted

Hesabi production runs on DarDev's dardev-vps infrastructure at OVH in the European Union—France region for the primary VPS that also hosts related DarDev platform services under isolated Docker Compose stacks. Customer tenant data for Hesabi does not share a database with unrelated products; Postgres instances and volumes are scoped to the mailer and application stack documented in our deployment runbooks.

Tunisian PMEs often ask whether data leaves Tunisia. In practice, cloud-hosted SaaS for Tunisian businesses commonly resides in EU datacenters operated by providers like OVH because local dedicated fiscal-cloud options remain limited. We document region, provider, and logical isolation so your DPO or accountant can map this to contract and regulatory expectations. Broader MENA residency trade-offs for B2B platforms are covered in our mena-data-residency-b2b guide when your parent company spans multiple jurisdictions.

Role-based access control (RBAC)

Hesabi uses role-based permissions so daily operations do not require everyone to hold owner-level keys. Typical roles map to how Tunisian PMEs actually work: a business owner or general manager oversees company settings and user invitations; finance staff create and approve invoices; sales or operations may capture drafts without clearance authority; external accountants receive export or read-scoped access instead of shared credentials.

• Owner / admin: company profile, billing plan, user invites, integration settings
• Finance manager: invoice lifecycle, payments, bank import, clearance submission where authorized
• Operations / sales: customer and catalog maintenance, draft invoices, attachments
• Accountant (external): export packages, read-only registers, no destructive master-data edits
• Auditor / read-only: historical registers without write paths when enabled for reviews

RBAC only works if you assign it during week-one setup—not after six months of shared logins. The hesabi-dashboard-first-week walkthrough includes inviting a backup admin and scoping accountant access before TTN volume increases.

Accountant access versus owner access

The most common security failure we see is an expert-comptable logging in with the owner's password because exports were urgent. That bypasses audit trails, breaks turnover hygiene, and confuses liability when a master-data change precedes a VAT mismatch.

Preferred pattern: invite the cabinet as a dedicated user with export and read permissions appropriate to their engagement letter. Owners retain user management, plan changes, and integration credentials. Finance managers sit in the middle—they run daily clearance and lock periods before monthly exports. When a correction is needed, issue credit notes inside Hesabi so the hesabi-audit-trails-exports article describes a single chronological record rather than parallel spreadsheets.

1. Owner invites accountant

   Named email per cabinet staff member; no generic cabinet@ shared login.

2. Scope permissions

   Exports and registers yes; delete company or change VAT regime no unless contract requires.

3. Agree export calendar

   Monthly pull after finance locks the period—reduces ad-hoc owner credential sharing.

4. Review access quarterly

   Remove departed staff; rotate when cabinet engagement ends.

Backup and recovery policy

DarDev operators take daily PostgreSQL logical dumps of production databases on dardev-vps, compress them, and copy backups off the VPS to separate storage. Stalwart mail volumes and file uploads follow documented tarball procedures in our backup runbook. Restore drills are scheduled—not claimed as continuous replication to a second region unless contractually agreed for a specific enterprise deployment.

• Daily automated database dumps with retention window defined in ops runbooks
• Off-server copy so single-VPS loss does not destroy the only backup
• Environment secrets backed up encrypted and stored separately from application dumps
• Customer-initiated exports (CSV, registers) as an additional business-level backup you control

RPO and RTO for standard Hesabi SaaS are honest mid-market numbers: hours of data replayable from nightly dumps, and a documented restore path measured in hours to a rebuilt VPS—not minutes via multi-region active-active. Enterprise buyers needing stricter targets should discuss dedicated hosting or enhanced backup tiers during sales review.

Subprocessors and third parties

Hesabi relies on infrastructure and service providers we disclose in due-diligence packets. Core hosting is OVH (EU region VPS and networking). TLS certificates are issued via Let's Encrypt through our nginx stack. Email notifications for product and operational messages use DarDev's Stalwart MTA on send.dardev.net—outbound marketing and transactional streams stay separated from @dardev.net inbound mail, which remains on Zoho for corporate email.

Payment processing for Hesabi subscriptions, if applicable to your plan, routes through the payment provider configured on hesabi.tn—we list the current processor name in contracts rather than assuming one global vendor. TTN El Fatoora itself is a government-operated clearance endpoint; invoice payloads transit to Tunisie TradeNet under your company's enrollment, not as a DarDev subprocessor holding your ledger long term.

• OVH — compute, storage, networking (EU)
• Let's Encrypt / ACME — TLS certificate automation
• DarDev Stalwart — product email delivery from send.dardev.net
• Payment provider — as named on your Hesabi agreement
• TTN — clearance authority (government platform, not commercial hosting)

What we tell enterprise and mid-market buyers

When a Tunisian scale-up or a multinational subsidiary evaluates Hesabi, procurement asks predictable questions. We answer with evidence, not aspirational certifications we do not hold.

• Data location: OVH EU region VPS; logical tenant isolation in Postgres
• Encryption: TLS in transit; encrypted disks at rest; secrets not in git
• Access control: RBAC with owner, finance, and accountant scopes; audit trails on invoice changes
• Backups: daily dumps, off-server copies, documented restore runbook
• Subprocessors: written list with purpose and region; updates on contract change
• Incident response: operator contact path via DarDev support channels; post-incident summary for affected tenants when applicable
• Compliance scope: Tunisia fiscal workflows (VAT, TEJ, TTN-oriented features); not a substitute for legal opinion on Law 2004-63 or sector regulators

We do not claim SOC 2 Type II or ISO 27001 certification unless and until published on dardev.net. Buyers who need penetration-test reports or custom DPAs should request them during enterprise evaluation—we scope custom security work through DarDev Services when standard SaaS documentation is insufficient.

Practical security checklist for PME admins

1. Disable shared owner credentials; invite named users per role
2. Enforce two-person rule for TTN clearance if finance team has more than one person
3. Test accountant export path before peak declaration season
4. Review user list after any staff or cabinet change
5. Store downloaded exports on encrypted company devices or cabinet systems only
6. Keep a single internal contact for security questions during audits

Hesabi and DarDev support

Hesabi is DarDev's Tunisia-only FinTech platform for SME finance on hesabi.tn. Security questions during evaluation should go through official Hesabi contact channels; implementation of roles and exports should start in week one alongside your accountant.

Explore hesabi.tn for product access, read related guides on news.dardev.net, and contact DarDev if you need enterprise documentation or custom hosting review through DarDev Services.