Built for trust and protection.
Umrah Connect handles pilgrim data, payments and operator records — security and compliance are foundational, not afterthoughts.
Encrypted authentication
JWT-based sessions with short-lived access tokens and rotating refresh tokens. Passwords are hashed with bcrypt.
Role-based access control
Granular permissions enforced per endpoint, scoped per tenant, so every user only sees what their role allows.
Multi-tenant isolation
Tenant data is isolated from the database up — no cross-tenant leakage between operators, hotels or agencies.
Audit logging
Every meaningful mutation is recorded with actor, action and timestamp, visible to Super Admin governance.
KYC verification
Providers are verified through a KYC workflow before they can transact on the marketplace.
Secure by design
Hardened HTTP headers, input validation on every request, and upload safeguards across the platform.
Questions about security or compliance?
Our team is happy to walk through how Umrah Connect protects your data.