Built to Saudi & GCC standards.

Zbon adheres to the principles of Saudi Arabia's Personal Data Protection Law. We process your data according to the principles of transparency, purpose limitation, data minimization, and accountability. Every data processing operation is recorded in a permanent audit log you can access anytime.

• •Full right of access to your data
• •Right to correction and deletion on request
• •Data breach notification within 72 hours
• •Explicit consent before any new use
• •Data encryption in transit and at rest

Zbon's architecture is prepared for integration with the Zakat, Tax and Customs Authority's e-invoicing system. When official integration becomes available, you will be able to issue tax invoices directly from the platform in an approved format (XML/PDF-A3) with electronic signature and QR Code.

• •15% VAT support
• •Data structure aligned with ZATCA requirements
• •Prepared for Phase 1 (Generation) and Phase 2 (Integration)
• •Auditable records retained for 6 years

Zbon adheres to the Essential Cybersecurity Controls set by the Saudi National Cybersecurity Authority. We implement identity and access management, data encryption, security event monitoring, and incident response plans.

• •Multi-factor authentication (MFA)
• •TLS 1.3 encryption for all communications
• •Real-time security event monitoring
• •Encrypted daily backups
• •Approved incident response plan

We are currently working to offer a data residency option within Saudi Arabia via locally-approved cloud providers (STC Cloud, Oracle Jeddah, AWS Bahrain me-south-1). This option will be available for Enterprise plans soon.

• •In-Kingdom storage option (soon)
• •Logical separation of each customer's data
• •Full data sovereignty for the customer

Have a compliance or data-handling question?