Security and Confidentiality
How Moha keeps client and employee information confidential, how to report a security issue, and how to spot recruitment fraud in our name.
- Version
- 1.0
- In force from
- Last updated
1. How we keep information confidential
Clients trust us with their plans, and their people trust us with passports, salaries and bank details. We treat all of it as confidential and use it only for the work it was given for.
- Access by role. Each person in the platform sees only what their role needs, and pay details only reach the roles that need them. Our own team works under the same rules.
- Confidentiality. Our staff are bound by confidentiality. With each client, we keep its confidential information confidential while our agreement lasts and after it ends, as section 10 of the Client Services Agreement says.
- A record of every change. The platform records who did what and when. Clients can see their own record.
- Encrypted connections. Our website and platform are served over HTTPS, so data is encrypted on its way between your browser and our server.
- Passwords. They must have at least 10 characters, and we store them only as one-way hashes, so no one can read them, our team included.
- Two-step sign-in, being added. Every account will confirm sign-ins with a code from an authenticator app or, for clients and employees, a code by email, with backup codes. Our own team will use an authenticator app. The secrets behind it are encrypted where they are stored.
- Checked files. The platform checks each uploaded file’s type and size, and deletes files that are never added to anything after a day.
- Limits on repeated tries. Too many sign-ups or messages from one address are refused for a while.
- Every company checked. Before a company can hire through us, we check its licence or registration, that its website and email domain match, the sanctions lists, and that the person signing up can sign for it.
- Where the data is. Our website, platform and database are hosted by Render, in Frankfurt, Germany. Our Privacy Policy explains what that means for you.
2. Reporting a security issue
If you think you have found a weakness in our website or platform, email contact@employerofrecord.ae with “Security” in the subject. Tell us what you found, where, and how to see it again.
We confirm we received it within 3 working days, keep you informed, and tell you when it is fixed.
Testing the security of our platform needs our written agreement first, as the Platform Terms of Use say. If you come across a weakness, stop there and tell us. Don’t look at more data than you need to show the problem, don’t change or delete anything, and give us time to fix it before telling anyone else.
Our security contact is also in our security.txt file, the standard place security researchers look.
3. Recruitment fraud
People sometimes pretend to recruit for real companies to take money from job seekers. This is how we work:
- We never charge candidates or employees any fee: not for a job offer, an interview, a work permit, a visa, a medical test or an Emirates ID. Under Article 6 of the UAE Labour Law, an employer may not charge a worker the fees and costs of recruiting or employing them, directly or indirectly.
- We never ask you to send money to a personal bank account, a money transfer service or a crypto wallet.
- We never keep your passport. Taking a worker’s passport is prohibited in the UAE.
- We email you only from addresses ending in @employerofrecord.ae.
If someone asks you for money in our name, don’t pay. Email us at contact@employerofrecord.ae with what you received, and report it to the police.
4. How to check a message really comes from us
- Our website is employerofrecord.ae, and our platform is at employerofrecord.ae/app/. Check the address bar before you sign in or upload anything.
- Our emails come from addresses ending in @employerofrecord.ae. Look at the full address, not only the name shown.
- Links in our emails go to employerofrecord.ae. If a link goes anywhere else, don’t open it.
- We never ask for your password or a sign-in code by email, phone or message. Our team cannot see your password.
- Our bank details are on your invoice in the platform. If a message says they have changed, don’t pay: check with us in the platform first.
- If in doubt, write to contact@employerofrecord.ae as a new email, not as a reply to the message, and ask us.
5. Changes to this page
We update this page when how we work changes. Anything marked “being added” is not live yet, and we update it when it is.