Security
Trust built on facts, not on claims.
A business system runs on the honesty of its numbers. Here is exactly what we do today to keep those numbers, and the people behind them, safe. Anything on our roadmap is labelled as such - never conflated with what already ships.
Per-tenant isolation
Each customer's data is separated at the row and connection level, so a tenant's queries can never traverse another tenant's tables.
Encryption in transit and at rest
TLS 1.2+ for all traffic to and from the product. AES-256 for data at rest, with keys rotated on a set cadence.
Role-based access control
Roles are the unit of access - cashier, manager, accountant, owner. Permissions are enforced server-side and audited on every read and write.
Audit trails on every event
Sales, refunds, ledger entries, stock adjustments and permission changes are all logged with actor, time and payload - queryable, exportable, immutable.
Authentication
- Password hashing with modern, memory-hard algorithms
- Optional multi-factor authentication per user
- Session revocation from any admin device
- Terminal-level PIN unlock for shared counter registers
Authorisation
- Role-based permissions across every module
- Field-level restrictions where finance data is sensitive
- Location-scoped access for multi-store operations
- Time-boxed elevated access with an audit reason code
Infrastructure
- Indian data centre regions by default
- Segregated production and non-production environments
- Backups taken on a set cadence with restore drills
- Least-privilege access for our own operations team
Compliance posture
- Statutory compliance for GST, e-invoice and e-way bill inside the product
- Data processing terms available on request as part of contracting
- Formal certifications on the roadmap are labelled as roadmap, not as claim
Responsible disclosure
If you believe you have found a security issue, please share it privately through our contact form with the subject line "Security". We will acknowledge you within two business days.