Data security

Your brokerage’s data, protected at every step.

Your leads, client details and WhatsApp conversations are the most valuable thing your brokerage owns. Here is exactly how Majlis protects them.

  • TLS 1.3 in transit
  • AES-256 for files and keys
  • Brokerages fully isolated
  • Every change audited

Last updated 22 October 2026

Encrypted in transit

Every connection to Majlis is encrypted, from the app on an agent’s phone to our servers and back.

  • TLS 1.3 by default, and never below TLS 1.2, on the app, the website and the API.
  • Plain HTTP is redirected to HTTPS, and browsers are told to use HTTPS only (HSTS).
  • Messages from WhatsApp, Facebook lead ads and Stripe are checked against their signature before Majlis accepts them, so nobody can pretend to be them.

Encrypted at rest

Your leads, contacts, conversations and files are encrypted where they are stored.

  • The database runs on AWS managed PostgreSQL, encrypted at rest, on a private network that cannot be reached from the internet.
  • Uploaded files, such as listing photos and client documents, are stored on Cloudflare R2 with AES-256 encryption.
  • The keys you connect with (WhatsApp, Bayut, Property Finder, Google Calendar, Facebook) are encrypted again by Majlis with AES-256-GCM before they are saved.
  • The database is backed up automatically every day, with point-in-time restore for the last 7 days.

Each brokerage is walled off

One brokerage can never see another brokerage’s leads, agents, listings or conversations.

  • Every read and write is limited to your workspace at the data layer, automatically, rather than relying on each screen to remember.
  • Asking for a record from another workspace returns nothing, as if it did not exist.
  • We test the boundary by signing up two brokerages and trying to reach one from the other.
  • Each WhatsApp number belongs to one workspace, and incoming messages are routed by the number they were sent to.

People see only what you allow

Owners decide what each person in the brokerage can see and do, and the server enforces it.

  • Agents see their own leads, the leads they follow and the General Pool, unless you give them more.
  • Each page can be switched on or off per person, and imports, exports and bulk actions have their own permissions.
  • WhatsApp access can be read only, and agents only see the numbers they are allowed to.
  • When someone leaves, their access ends within 30 seconds and their leads move to the General Pool.

Majlis staff do not browse your data

Our team has no routine access to your conversations or client records.

  • Majlis staff use a separate console with separate accounts and keys, kept apart from every brokerage’s sign-in.
  • When support needs to see what you see, they open your workspace read only, for an hour at most. They cannot change anything.
  • Every time they do, it is written to your own audit log as Majlis support, with who and when.

AI that handles data carefully

Majlis AI is useful because it reads your conversations, so it is built to read only what it needs.

  • Only the conversation, note or recording being worked on is sent, with the CRM details needed to answer.
  • AI runs through OpenAI’s API, whose terms say data sent through the API is not used to train their models.
  • Majlis keeps no log of the text sent to the AI, only how much was used.
  • The AI never sends a message on its own. What it changes is shown on the chat and can be undone for 24 hours.
  • Each workspace chooses which AI features are on.

A full audit trail

Every change in Majlis is recorded, so you can always see who did what.

  • Edits, stage moves, reassignments, deletes, imports and exports are logged with the person and the time.
  • An edit shows what changed, from the old value to the new one.
  • Owners choose who can read the audit log.

Sign-in and sessions

Accounts are protected from guessing and from stolen sessions.

  • Passwords are stored as bcrypt hashes, never as text, and new team members get a generated password they must change.
  • Sign-in attempts are rate limited, so passwords cannot be guessed at speed.
  • Sessions are kept in secure, HTTP-only cookies that page scripts cannot read.
  • Card payments are handled by Stripe. Card numbers never reach Majlis.

Your data stays yours

The leads and conversations in Majlis belong to your brokerage.

  • Export your contacts and leads to a spreadsheet at any time.
  • If a subscription lapses, the workspace becomes read only. You are never locked out of your own data.
  • Error reports leave out IP addresses, cookies and what was sent, and session recordings hide every name and everything typed.
  • Photos have their location data removed when they are uploaded.

Security questions

Is my brokerage's data safe in Majlis CRM?

Yes. Data is encrypted in transit with TLS 1.3 and encrypted at rest, every brokerage is walled off from every other at the data layer, and every change is recorded on an audit trail.

Can another brokerage on Majlis see our leads?

No. Every read and write in Majlis is limited to your own workspace automatically, so a lead, agent, listing or conversation from one brokerage can never appear in another.

Can Majlis staff read our WhatsApp conversations?

Majlis staff have no routine access to your conversations. If support needs to look at your workspace to help you, they do it read only, and each time is recorded in your own audit log.

Is our data used to train AI?

No. Majlis AI runs through OpenAI's API, whose terms say API data is not used to train their models. Only the conversation or note being worked on is sent, and Majlis does not log the text.

Can agents see each other’s leads?

Only if you allow it. By default an agent sees their own leads, the leads they follow and the General Pool. Owners set what each person can see and do, and the server enforces it.

What happens to our data if we stop paying?

Your workspace becomes read only. Nothing is deleted, you can still sign in, and you can export your contacts and leads to a spreadsheet at any time.

Questions, or found a security issue?

Write to us and a person answers. If you think you have found a vulnerability, please tell us before sharing it, and we will work with you on it.

support@majliscrm.com

How we use personal data is in our privacy policy.

See how Majlis keeps your leads safe.

A 30-minute walkthrough of permissions, the audit log and more.

Book a demoStart free trial