Who we are

Mizan is operated by Point of Trade Co. (“POT”), a company registered in the State of Kuwait. Mizan helps entities prepare, validate and export financial statements in XBRL for filing with the Ministry of Commerce and Industry through its Qayd portal.

For anything in this policy, write to info@pot-mizan.com.

What we hold

We deliberately hold as little as the job requires. Specifically:

• Filing data — the financial statement figures you enter or upload, the chart of accounts you map, and the XBRL instances generated from them.
• Account data — the name, email address and role of each person you invite, and which entities they may reach.
• Operational records — an audit log of actions taken in your account, validation results, and API request records (which key, which endpoint, when).

We do not receive or store your underlying accounting transactions, bank data, or customer records. Mizan works from finished statement figures, not from your ledger.

Where it is held

All Mizan data is stored on infrastructure operated by Point of Trade inside the State of Kuwait. It is not replicated to a foreign cloud region.

The database holding filing data is not reachable from the public internet. It accepts connections only from the Mizan application itself.

How it is protected

• Traffic between you and Mizan is encrypted in transit (TLS).
• Passwords are stored as Argon2 hashes; we cannot read them, and neither can anyone who obtains the database.
• API keys are stored only as hashes. A key is shown once, at creation, and cannot be retrieved afterwards.
• Credentials for any accounting system you connect are encrypted before storage, with a key held outside the database.
• Access to your account is scoped per entity, and every action is written to an audit log.
• Staff access to the back office requires a second authentication factor, and every staff action is recorded separately from your own audit trail.

Who else sees it

We do not sell your data, and we do not use it to train anything.

Point of Trade staff may view your account for support. Viewing your financial figures is a distinct, deliberate action and is recorded against the named member of staff. There is no facility for staff to sign in as you.

We share data with a third party only where you ask us to (for example, an accounting system you connect), or where Kuwaiti law requires it.

How long we keep it

Filing data is retained while your subscription is active, and afterwards for as long as you may reasonably need it — a filing you made is a statutory record you may be required to produce years later. Ending a subscription suspends access; it does not delete your filings.

You can ask us to delete an entity and its filings. We will confirm before doing so, because deletion cannot be undone.

Your choices

You may ask us for a copy of the data held about you, ask us to correct it, or ask us to delete it. Account owners can add and remove people themselves at any time.

Mizan sets a session cookie so that you stay signed in, and remembers your language choice. It carries no advertising or third-party tracking cookies.

Changes

If this policy changes materially we will say so on this page and, for changes that affect how we handle filing data, tell account owners directly.