Security

1. Your data stays in your account

• Database row-level security separates every account’s data, so one franchise cannot read another’s clients, prices, consignments, or invoices.
• Actions that change data, especially administrative ones, check that you own the records involved before they run. Internal administrative functions are not exposed to the public internet.
• If you run more than one Franchise, each Franchise’s data is kept apart and the app works on one active Franchise at a time.

2. Sign-in and account protection

• Passwords are hashed by our authentication provider; we never see or store them in plain text.
• We email a one-time code to verify your address at signup and for sensitive actions.
• Repeated attempts on sensitive endpoints are rate-limited to slow down guessing and abuse.
• You can permanently delete your account and its data yourself from Profile → Security, after confirming your email.

3. Data in transit and at rest

• All traffic between your browser and Courier Billing uses HTTPS/TLS.
• The app sends browser security headers, including a content-security policy that restricts where code can be loaded from and where data can be sent.
• Uploaded spreadsheets and generated invoice PDFs are kept in private storage. Downloads use short-lived signed links, never public URLs.
• We keep backups so that data can be recovered after a hardware or software failure.

4. Payments

Card and UPI details are entered on Razorpay’s checkout and go directly to Razorpay; we do not store full card numbers. We verify the signature on every payment notification before we change an account’s plan, and we ignore notifications that fail that check.

5. How we build and run the service

• Automated secret scanning blocks credentials from being committed to our code.
• Database changes pass automated safety checks and behavioural tests before they ship.
• We monitor for errors with Sentry, configured not to collect default personal data. Error reports carry an internal user ID, not your name or email.
• We review dependencies and apply patches, and we can ship emergency fixes without notice.

6. What you can do

• Use a strong, unique password and keep your login email secure.
• The app can keep an offline copy of your data on your device. Protect the device with a passcode and sign out on shared computers.
• Tell us straight away if you think someone else has accessed your account.

7. Reporting a vulnerability

If you find a security problem, email support@courierbilling.in with the steps to reproduce it. Please do not access, change, or keep data that is not yours, and give us reasonable time to fix the issue before you disclose it. Our Terms still apply to any testing.