Controls that exist today, and a roadmap labelled as one
Finance teams should know exactly what protects their data. Everything under “Implemented” is in the product now. Everything under “Roadmap” is not yet.
Implemented in the product
These controls are part of Naarvin today.
One control at work on demo data: the same question, asked by two people with different access.
Revenue · August 2026 · SAR thousands
Group CFO · All entities
- Saudi Arabia
- 2,487.3
- Egypt
- 1,657.2
Finance manager, Egypt · Egypt only
- Saudi Arabia
- Not included (no access)
- Egypt
- 1,657.2
Egypt converted at the August 2026 average rate (EGP → SAR 0.067175).
Isolation
- In the product today
Database-enforced tenant isolation
PostgreSQL row-level security separates each organization’s data in the database itself, not only in application code.
Access
- In the product today
Entity-scoped, role-based access
Roles apply per entity. A finance manager for Egypt sees only Egypt: in reports, in figures and inside the Copilot.
- In the product today
Two-factor sign-in
Time-based one-time passwords (TOTP) add a second factor at sign-in.
- In the product today
Step-up verification
Sensitive actions ask for a fresh two-factor check, even within an active session.
- In the product today
Approval limits and segregation of duties
An authority matrix sets amount tiers per action type. Nobody approves their own request, and each person decides once.
AI boundaries
- In the product today
The AI never holds ERP credentials
The Copilot has no ERP credentials and no unrestricted database access. It can only call finance tools that check permissions first.
- In the product today
Every AI number bound to stored data
Each number in an AI answer must be bound to a stored figure that can be replayed and traced to its transactions.
Accountability
- In the product today
Append-only, hash-chained audit log
Entries can only be added, and each one is chained to the entry before it, so edits or gaps can be detected.
- In the product today
Recorded data syncs
Scheduled syncs keep a run history, so you can see when data last arrived and whether a run failed.
On the roadmap
Not available yet. This page changes when each item ships.
- Roadmap
In-Kingdom hosting
Hosting in Saudi Arabia for groups with data residency requirements.
- Roadmap
KMS envelope encryption
Envelope encryption with keys held in a managed key service.
- Roadmap
Single sign-on
Sign in through your organization’s identity provider.
- Roadmap
Compliance roadmap
Independent assessment of our controls. We’ll share scope and timing once they’re confirmed.
- Roadmap
Penetration testing
Independent penetration tests, with findings tracked to resolution.
No certification claims
Naarvin doesn’t hold security certifications today, and this site shows no badges we haven’t earned. If your security team has a questionnaire, we’ll answer it item by item.
- Security certifications
- None held today
Questions from your security team?
Bring them to the demo. We’ll show each control in the product.