Security, governance and delivery assurance
ERP and e-invoicing projects touch your customers, prices, invoices and payroll. This page sets out, in plain words, how Kaido governs a project, where your system can be hosted, how we handle your data, how support works, and how this website treats yours.
How we work with your data
NDA before discovery
On request, we sign a non-disclosure agreement before discovery starts.
Least-privilege access
We ask only for the access a task needs, for as long as it is needed. You stay the administrator of your systems.
Access removed at handover
When the work is handed over, our access to your systems is removed.
Approved environments
Data migrations run on environments you approve before anything reaches your live system.
No marketing use
We do not use client data for marketing.
One accountable expert
The industry expert who scopes your project delivers it, so you know who is working in your systems.
Project governance and sign-off
Every implementation runs through four gates, and each one ends with your written sign-off before the project moves on.
- 1Blueprint. Scope, price and timeline written down and signed.
- 2Build. The system configured to the signed blueprint.
- 3Migration. Data reconciled against your old system, then tested and accepted by your team.
- 4Go-live. Launch, then post-launch cover.
Written sign-off comes before each payment. If a gate is not met, we do not proceed to the next phase. The industry expert who scopes your project delivers it, so one person stays accountable from blueprint to go-live.
Hosting and deployment options
Where your system runs depends on the platform you choose. We agree the hosting option with you before anything is bought.
| Platform | Typical hosting |
|---|---|
| Odoo | Odoo's own cloud services, Odoo Online or Odoo.sh |
| Microsoft Dynamics 365 Business Central | Microsoft's cloud |
| Oracle NetSuite | Oracle's cloud |
| Oracle Fusion Cloud ERP | Oracle's cloud |
| SAP Business One | On your own servers (on-premise) or hosted by a partner |
Data residency. Where your data is stored depends on the platform and the hosting region you choose. If your policy requires data to stay in a particular country or region, tell us at the start and we will check the options each platform offers with you before you commit.
Access controls
- Least privilege. We ask only for the access a task needs, for as long as it is needed. You stay the owner and administrator of your systems.
- Named accounts. Each person on our team uses a named account, never a shared login.
- Removal at handover. Our access is removed at handover. If you keep us on support, access is agreed again for that work.
Data migration controls
- Trial migrations. We run trial loads on a test or staging copy you approve before anything reaches your live system.
- Reconciliation. Each trial load is reconciled against your old system.
- Client sign-off. Your team signs off the reconciliation before go-live.
Backup and recovery
Backups follow the backup service of the platform that hosts your system. Restoring from a backup is part of Kaido's go-live checklist: before go-live we confirm with you that a restore works.
Confidentiality
- NDA on request. If you ask, we sign a non-disclosure agreement before discovery starts.
- No client data in marketing. We do not use client data for marketing.
During a project
Before discovery. If you ask, we sign an NDA first. You can then share process documents, reports and sample data under it.
Access to your systems. You create the accounts and grant the roles. We ask for the narrowest access that lets us do the task in front of us, and we tell you when a task needs more.
Data migration. Migrations run on environments you approve, such as a test or staging copy of your system. We run at least two trial loads and reconcile them, and your team signs off the reconciliation before go-live.
At handover. Our access is removed at handover. As part of the handover we ask you to disable the accounts you created for us, and we stop using any credentials we were given. If you keep us on support, access is agreed again for that work.
E-invoicing work. Your invoices are exchanged and reported by the Accredited Service Provider you contract. Kaido is not an ASP. We configure your ERP and the connection, and you remain responsible, with your ASP, for retaining e-invoices as the Ministry of Finance guidelines require.
Support arrangements and response times
After go-live every project has post-launch cover. Ongoing support runs under an annual maintenance contract (AMC). These are our response times:
Business hours: Sunday to Friday, 9:00 to 18:00 Dubai time
| Request | Response time | Coverage |
|---|---|---|
| Critical: system down | Within 1 business hour | Business hours, AMC clients |
| High | Within 4 business hours | Business hours, AMC clients |
| Standard requests | Within 1 business day | Business hours, AMC clients |
| General enquiries | Within one business day | Business hours, open to anyone |
What an AMC includes: monitoring, bug fixes, minor changes, user support and a set number of support hours each month.
How to raise a critical incident: call +971 54 468 3459, or message us on WhatsApp on the same number, and email support@kaidolab.com with the system affected, what stopped and when it started.
This website
- Hosting. kaidolab.com is hosted on Netlify and served only over HTTPS, with security headers such as HSTS and a content security policy.
- Forms. Contact, review and guide forms are processed by Netlify Forms and delivered to us. We use what you send to reply to you. Our privacy policy says how long we keep it.
- Booking. Consultations are booked through Calendly.
- Analytics and session recording. We use Google Analytics and advertising tags, and Microsoft Clarity to see where the site confuses people. Clarity masks what you type into form fields. Visitors in the EEA, the UK and Switzerland are recorded only after they accept on the consent banner; elsewhere, choosing Decline stops recording. The privacy policy has the detail.
Report a security issue
If you find a security issue on this site, email support@kaidolab.com. Our contact for security reports is also published in security.txt. We reply within one business day, Sunday to Friday.
Questions about security and data
Will you sign an NDA before discovery?
Yes. If you ask, we sign a non-disclosure agreement before discovery starts, so you can share processes, reports and sample data under it.
What access do your consultants need to our systems?
Only the access a task needs, for as long as it is needed. You stay the owner and administrator of your systems and decide what to grant.
What happens to your access when the project ends?
Our access is removed at handover. We ask you to disable the accounts you created for us as part of the handover, and we stop using any credentials we were given.
Where do you run data migrations?
In environments you approve, such as a test or staging copy, before anything is loaded into your live system.
Do you use our data in your marketing?
No. We do not use client data for marketing.
Do you hold a security certification?
This page describes how we work. It does not claim any security certification. If your policy requires specific controls or documents, tell us in the first call and we will say plainly what we can and cannot provide.
Need these points in your vendor questionnaire? Book a free consultation