Security
You're trusting us with your customers' phone numbers. Here's what we do about that.
No badges we haven't earned. This is what's in place today, and most of it is checked by automated tests every time we change the code.
Credentials encrypted
Razorpay keys, WhatsApp tokens and other secrets are encrypted at rest. Staff can't read them in the admin.
Workspaces kept apart
Every database query is scoped to one workspace. Automated tests try to read across workspaces on every change, and fail the build if they can.
Signed webhooks
Payment and WhatsApp events are accepted only with a valid signature from Razorpay, Cashfree, Stripe or Meta. Webhooks we send to you are signed too.
Card and UPI details never reach us
Payments run on the PCI-DSS certified checkout of Razorpay, Cashfree or Stripe. We only see the result.
Rate limits and bot checks
Sign-in, sign-up and public forms are rate limited. Click floods and form spam are filtered.
Hosted in India
Servers in Indian data centres, with daily backups.
Found a security problem?
Please tell us privately through the contact form and pick "Something else". We reply within two business days, and we'll credit you if you'd like.