Security Whitepaper.

Security & Trust

How Maklor protects the data of UAE real estate firms — data residency, encryption, access control, activity records, and the liability boundary of the Maklor Assistant.

Version: 1.0
Published: September 2026
Classification: Public

Mulklick GmbH · [UAE REGISTERED ADDRESS — TO BE COMPLETED]

01. Executive Summary & Scope

Maklor is the operating infrastructure for UAE real estate. The data it holds — listings, client relationships, valuations, and financing documents — is among the most sensitive a brokerage manages. This document describes the controls that protect it.

Maklor is operated by Mulklick GmbH [UAE ENTITY DETAILS — TO BE COMPLETED]. The platform is engineered around a single principle: a firm's data belongs exclusively to that firm, is processed in line with the UAE Personal Data Protection Law (PDPL), and is never exposed to autonomous action it did not authorise.

This whitepaper covers the Maklor production platform and its supporting infrastructure. It is intended for the security, compliance, and IT leadership of firms evaluating Maklor for enterprise deployment. Specific configuration details can be discussed on request; no independent penetration test has been carried out to date.

At a glance

Data hosted in the European Union (Stockholm, Sweden; application server in the Netherlands) · AES-256-GCM for closing-file documents and mailbox passwords, AES-128 for calendar secrets, HTTPS (TLS) in transit · e-mail and password sign-in with director and agent roles · listing activity journal · subject to the PDPL · technical providers, some of them in the United States, with standard contractual clauses · the Maklor Assistant, which can never send, sign, or speak on a client's behalf.

02. Data Residency & Hosting

Maklor states where your listings, client relationships, and financial documents are processed. The platform is hosted in the European Union — database and files in data centres in Stockholm, Sweden, and the application server in the Netherlands. [CROSS-BORDER TRANSFER BASIS UNDER THE PDPL — TO BE VALIDATED BY COUNSEL.] Some features, however, rely on technical providers, some of them in the United States, with standard contractual clauses; US law, including the US CLOUD Act, may apply to those providers.

Data residency

Hosting location: Database and files: data centres in Stockholm, Sweden (EU/EEA). Application server: the Netherlands (EU).
Cross-border transfer: Database, files and application server stay within the EU/EEA. Some features rely on technical providers, some of them in the United States, with standard contractual clauses.
Jurisdiction: Mulklick GmbH is the data controller; for users in the UAE, processing is subject to the PDPL. [CONTROLLER ENTITY AND CROSS-BORDER TRANSFER BASIS UNDER THE PDPL — TO BE VALIDATED BY COUNSEL.]
Data residency: Data is hosted in the European Union: database and files are in Stockholm, Sweden, and the application server is in the Netherlands. Data is not hosted in the UAE.
Tenancy: Logical separation per firm: records carry the firm's identifier and requests are scoped to the signed-in user's firm.

Resilience

Each component runs in a single region: the application as two instances in one region (the Netherlands), the database and files in Stockholm. The application has a health check and restarts automatically on failure. There is no multi-zone failover, and no uptime or recovery objective (SLA, RPO or RTO) is committed at this stage.

Availability — health check of the application service, with automatic restart on failure.
Continuity — single-region deployment: database and files in Stockholm, application server in the Netherlands.
Independence — Maklor is not a property portal and does not commercialise your listing or client data.

03. Encryption

Data travels over HTTPS (TLS). At rest, Maklor itself encrypts two categories of data before storage: closing-file documents and mailbox passwords. Without its key, a closing-file upload is refused rather than stored unencrypted.

In transit

Transport: HTTPS (TLS) for traffic between browsers, the website and the application.
Cipher policy: TLS versions and cipher suites are set by the hosting providers, not configured by Maklor.
Transport security: HTTPS certificates are issued and renewed by the hosting platforms.

At rest

Algorithm: AES-256-GCM for closing-file documents and mailbox passwords, applied by Maklor before storage; a mailbox password stored before this format remains in AES-128 until it is re-encrypted. Calendar tokens (Google, Outlook) and the Apple app-specific password are encrypted with AES-128.
Key management: Keys are supplied to the application as server environment variables and are never stored in the database. Closing-file documents, mailbox passwords and calendar secrets use separate keys.
Key rotation: No per-firm keys and no scheduled rotation; each closing-file document records the fingerprint of the key that sealed it.
Not covered: Photos, other uploads and database records are not encrypted by the application; any disk encryption by the hosting provider is not asserted here.

Technical providers

Some features rely on technical providers, some of them in the United States, with standard contractual clauses. Data is sent to them only for the requested feature, with no other reuse.

04. Access Controls & Identity

Access to firm data depends on the signed-in account and its role. Agents work on their own listings; directors manage their agency's team. Requests for firm data are authenticated by the session cookie.

Authentication

Sign-in by e-mail and password; there is no single sign-on (SSO), SAML or OpenID Connect integration.
Multi-factor authentication (MFA) is not offered; the field app can be locked on the phone with a code or biometrics.
Session management — HttpOnly session cookie with a limited lifetime; a director can suspend a team member's access at any time.

Authorisation

Model: Two fixed roles: director (agency owner or manager) and agent.
Least privilege: Direction features answer 403 to non-director accounts; a listing belonging to another agency answers 404.
Internal access: Mulklick GmbH administrators of the hosting accounts can technically access stored data; Maklor keeps no log of its own of such access.
Offboarding: The agency director suspends a team member from the direction space; the application then refuses that account's requests.

Separation of roles

Directors manage team access; agents work their own listings; the Maklor Assistant prepares drafts but does not send, sign, or decide on its own.

05. Activity Journal & Monitoring

Maklor does not keep an audit log of views, edits, exports, or shares. What it records is a listing activity journal: events entered by agents on each listing, with when they happened and who entered them.

Coverage: Events entered per listing (visits, calls, offers, stage changes, documents, notes), plus the upload date, uploader and SHA-256 fingerprint of each closing-file document.
Integrity: A line removed by an agent is hidden, not erased; the journal is not cryptographically tamper-evident.
Availability: The journal is shown on each listing in the agent's workspace.
Monitoring: Health check of the application service with automatic restart on failure; no anomaly detection is claimed.

06. The Maklor Assistant Liability Boundary

The Maklor Assistant prepares the dossier, lists what is still missing, and drafts communications — but its authority is constrained in the architecture, not merely in policy. The boundary is a security control, not a marketing promise.

It cannot send: The Maklor Assistant cannot dispatch email or messages autonomously. Every communication waits for explicit human release.

It cannot sign: It cannot sign listings or commit your firm to obligations. The signature is always the agent's.

It cannot advise: It surfaces evidence and prepares the file; legal judgment remains with the broker.

Disclosed technical providers: Technical providers, some of them in the United States, with standard contractual clauses; suggestions are always reviewed by the agent.

07. Compliance, Operations & Contact

Regulatory alignment

PDPL: Processing for users in the UAE is subject to Federal Decree-Law No. 45 of 2021 on Personal Data Protection. [TO BE VALIDATED BY COUNSEL.]
Data processing: How personal data is processed is set out in the Privacy Policy and the Terms of Service published on maklor.ae.
Sub-processors: Supabase (database, file storage and sign-in, Stockholm, Sweden) · Railway (application server and SFTP import server, the Netherlands) · Vercel (website and dashboard, Frankfurt, Germany) · Technical provider (analysis of photos, documents and texts, transcription, United States) · Stripe (subscription payments and invoices — card details are handled by Stripe and never reach Maklor; Ireland and United States) · Infomaniak (account and notification e-mails, the United Arab Emirates) · Google (fonts on the website; push notifications on Android through Firebase Cloud Messaging; Google Calendar when a user connects it) · Apple (push notifications on iPhone; iCloud Calendar when a user connects it) · Microsoft (Outlook Calendar when a user connects it).
Public data sources: Dubai Land Department (DLD) open data · OpenStreetMap (points of interest). [OTHER UAE SOURCES — TO BE CONFIRMED.]
Data subject rights: Access, rectification, and erasure requests are handled by e-mail at support@maklor.ae, in line with the PDPL.

Secure operations

Development — the website and the application backend each have automated test suites.
Vulnerability reports — welcome at the security contact below; no independent penetration test has been carried out to date.
Incidents — subject to the data-breach notification duties of the PDPL.
Operator — Maklor is operated by Mulklick GmbH, [UAE REGISTERED ADDRESS — TO BE COMPLETED] (see Legal notice).

Security contact

Security questions, vulnerability reports, or questions about a control described here: support@maklor.ae.

This document is provided for informational purposes and describes the Maklor platform as of the version date above. It does not form part of any contract and may be updated. Specific commitments are governed by your agreement with Mulklick GmbH.