Home/Trust and your data

Trust and your data

Plain answers to the questions safety and IT teams ask before they let a crew use the app.

On your phone first: the app works offline and keeps your records in the phone's browser storage.
When you sign in, a backup copy and your company's shared records are kept on secure cloud servers run for AL-YASSIN by a large service provider. They may be stored outside Saudi Arabia. From app 3.7, a copy of what you save in the app is also kept there to run and improve the app, as part of the terms of use (see the privacy policy).
Sign-in codes and certificates are sent by email through a trusted email service.
Public pages (tag status, worker cards, client pages, safety record) show only the fields listed on each page, and their owner can turn them off.

Full ID, Iqama or passport numbers: the last 4 digits only.
Medical diagnoses: the result only (fit, fit with restrictions, unfit) with its dates.
Card or ID numbers on any public page.
The inspector's own position: the distance check (off unless the client's rule turns it on) keeps the scaffold's point and a distance in metres only.
Your password: the phone sends a one-way code made from it, and the server keeps only a salted hash of that code. The first time and once every 20 sign-ins, a code sent to your email confirms it is yours.

Sign-in tokens are stored hashed on the server and expire after 180 days; signing out ends the session on the server too. Five wrong passwords pause password sign-in for 15 minutes, and changing the password signs your other phones out.
Every record from a phone, a backup or another phone is checked field by field before it is shown.
Company records are kept per company; roles decide who sees and changes what, project by project and yard by yard.
Every change keeps who made it, from which device and when; material movements are cancelled, never deleted.
Signed copies carry a SHA-256 fingerprint, and inspection reports a fingerprint that the tag page checks.
Public pages are read-only, and the busiest ones have limits on how often they can be used.

We collect only what the app needs, ask for consent before a person is added to a crew register, and delete on request.
The Saudi Data and AI Authority (SDAIA) opened a public consultation (6 October to 5 November 2026) on draft amendments that would require controllers to store personal data inside the Kingdom. When the final text is published we will move storage if it applies to us. Until then, data is kept as described above.

AL-YASSIN is an independent platform. It is not endorsed by Saudi Aramco, OSHA, BSI, NASC, CISRS or any client. The signed tag fixed on a scaffold always rules over any page or app.