Amanah — something held on someone else’s behalf
Your records are not ours.
Neither is your money.
What we store, what never reaches us, and where the money settles.
The ledger
What we hold, and what never reaches us
Stored by imarah
- Student and guardian names and contact details
- Enrollment records, rosters, and attendance
- Tuition amounts, schedules, and payment status
- Hifdh progress — sabaq, sabqi, manzil
- Donor names, contact details, and giving history
- The last four digits of a card
Used to run your programs. We do not sell it, and there are no advertising trackers in imarah.
Never reaches our servers
- Card numbers
- CVV or security codes
- Bank account and routing numbers
- Online banking credentials
- Social Security numbers
None of it is stored, because none of it is sent to us. It goes from the browser to Stripe. A breach of imarah cannot expose a card imarah never received.
Safeguards
How the data we do hold is protected
One organization can never see another's records
Your data is walled off. No shared rosters, no shared donor lists.
Row-level security on every table. A query scoped to one organization cannot return another's rows, even if application code asks it to.
Encrypted in transit and at rest
Nothing travels or sits in the clear.
TLS 1.2+ on every request. AES-256 for the database and its backups.
Your Stripe keys are encrypted separately
Connecting your own Stripe account means handing us a key. We treat it like one.
AES-256 with a dedicated application key before it is written to the database. Never logged, never shown in the UI, never returned to a non-admin.
Card details go straight to Stripe
A card number goes from the browser to Stripe. It does not pass through imarah.
Stripe Checkout and Elements only. Cardholder data never reaches our servers, which places our integration under PCI DSS SAQ A.
Backed up daily
A mistake on a Tuesday is not the end of your records.
Automated daily backups, encrypted at rest.
Where the money sits
Donations land in your Stripe account, not ours
You connect your own Stripe account. Tuition and donations settle there and pay out to your bank on your schedule. imarah never holds a balance, so there is nothing for us to delay, freeze, or lose.
imarah bills a flat monthly subscription. No interest, no financing, no late penalties — the software has no mechanism to add one.
- Platform fee on donations
- 0%
- Money held by imarah
- $0
- Interest or late fees
- None
- What you keep if you leave
- All of it
Who else is involved
The four companies that touch your data
That is the whole list. No data brokers, no ad networks, nobody else.
Stripe
Card numbers, bank details, and payment processing
Supabase
The database and file storage
Vercel
The application itself
Resend
Outbound email — receipts, invoices, invitations
Still have questions?
Send us your security questionnaire, ask for a signed DPA, or tell us what your board needs to see.
Contact our team