Security first, always

At Tarabut, security is at the core of everything we do. Our dedicated security team works diligently to safeguard our systems, services, and data through comprehensive policies, rigorous compliance with regulations, and proactive risk management. We take a multi-faceted approach to security, covering five key areas that we focus on to ensure the protection and integrity of our systems.​

A comprehensive security approach

Governance, Risk, and Compliance (GRC)

Our security team develops and enforces policies, procedures, and standards to align with industry best practices and regulatory requirements. GRC ensures compliance, manages security certifications, and mitigates risks. By collaborating with regulators and clients, we demonstrate and maintain Tarabut’s robust security posture through continuous training and awareness.

Cloud Security

Our cloud security approach leverages industry-leading tools to secure our cloud infrastructure. By working alongside our engineering team, we integrate security tools that scan for vulnerabilities, enforce security protocols, and automate incident response to ensure a safe operating environment in the cloud.​

Application Security

Our security team ensures that all software development pipelines adhere to stringent security standards. They proactively identify and address vulnerabilities during the development phase, ensuring that application threats are remediated before reaching production. Regular testing and guidance help to maintain secure and compliant application infrastructures.

Security Operations

We monitor all Tarabut systems and services around the clock, providing 24/7 security oversight to detect and respond to potential threats. In partnership with trusted security experts, our team ensures swift investigation and resolution of security incidents, maintaining the integrity of our operations.​

Security by Design

Our Security by Design initiative ensures that security is embedded throughout every stage of product and project development. This approach enables Tarabut to build secure, scalable systems from the ground up, fostering a culture of security throughout our organisation and our systems.

Regulators

Central Bank of Saudi Arabia - SAMA

Tarabut is a permitted fintech, authorised by the Saudi Central Bank “SAMA” to operate in Saudi Arabia within the regulatory sandbox. We adhere to SAMA’s Cybersecurity Framework (CSF), which ensures comprehensive risk management and cybersecurity standards. This framework aligns with industry-leading practices like NIST and ISO, promoting strong resilience against cyber threats. Licensed by Ministry of Commerce (No: 1010682909) and SAMA sandbox number: 44071433

Central Bank of Bahrain - CBB

As a regulated entity under the Central Bank of Bahrain “CBB”, Tarabut complies with CBB’s regulations, including Volume 5 (Specialised Licensees), which governs capital requirements, risk management, and customer protection. These standards ensure financial integrity and operational security within Bahrain. Licensed by Ministry of Industry, Commerce & Tourism (No: 122765-1) and regulated by the Central Bank of Bahrain (No: ANC/024)

Certifications

ISO 27001:2022 Certified for Information Security

Tarabut was certified to ISO 27001:2022 by Citation Certification from March 2023 through July 2026, demonstrating our commitment to maintaining a robust Information Security Management System (ISMS) and protecting customer information.

While this certification is no longer active, our security framework, policies, controls, and risk management processes remain in place and continue to be actively maintained across the organization.

We are currently undergoing certification with a new certification body and are progressing toward obtaining a new ISO 27001:2022 certification. Security, privacy, and the protection of customer data remain core priorities for Tarabut.

Have any questions about security?

If you have any questions about the security measures and standards at Tarabut, please email

[email protected]