Your data is kept apart
Each customer gets a separate database for each product, rather than sharing tables with other customers. One customer's data can't be reached through another customer's account.
Signing in
- Multi-factor authentication with an authenticator app is available to every user, and on plans that include it, an organisation can make it compulsory for administrators or for everyone.
- Passwords are stored only as one-way hashes, never in readable form.
- Repeated failed sign-ins and password-reset requests are rate-limited, and password-reset responses don't reveal whether an email address has an account.
- Each product has its own sign-in session. Session cookies are marked Secure and HttpOnly.
- Our own staff need multi-factor authentication to use the platform console.
Who can do what
- Every product has roles and permissions, so people see and change only what their job needs. Administrators can adjust an individual user's permissions.
- API access is granted per request, with scoped tokens that can be revoked at any time.
A history of every change
Every product records who added, changed or deleted each record, and when — including what the values were before and after. Your administrators can review it on each record; the organisation-wide change log and its export come with each product's higher plans.
Encryption
- All traffic uses HTTPS, with HTTP Strict Transport Security turned on.
- Secrets stored in the products, such as connection credentials and API keys, are encrypted in the database.
Payments
Payments are handled by Razorpay. Card, UPI and bank details go straight to Razorpay; we never see or store them. Every payment notification from Razorpay is checked against its signature before we act on it.
Infrastructure
The products run on servers provided by Hostinger, and are delivered through Cloudflare, which also protects them against attacks. We can block abusive IP addresses at the platform level.
Certifications
We don't hold SOC 2 or ISO 27001 certification yet. If your organisation needs details for a security review or vendor questionnaire, email us and we'll answer directly.
Report a security issue
If you think you've found a vulnerability, email [email protected] with the details. Please don't access or change other people's data, and give us reasonable time to fix the issue before you share it. We'll acknowledge your report and keep you informed.