Security by design.

Every workspace is isolated. Database queries on tenant data are rejected unless they are scoped to one workspace, and this is covered by automated tests.

Sessions use random 256-bit tokens that are stored hashed and can be revoked. Sign in with a password, an emailed one-time code (hashed, limited attempts, expires in 10 minutes) or Google.

Access is controlled by roles and fine-grained permissions per module. Impersonation by platform staff is audited.

Prices, tax and stock are calculated on the server. Razorpay payments are confirmed by signature and webhook and applied exactly once. We never store card details.

Important changes are recorded in an activity log you can review inside your workspace.

Found a vulnerability? Message us on WhatsApp at +91 70134 59930 and we will respond promptly.