Trust & security
A franchise platform holds other people's businesses: their sales, their agreements, their staff. Here is how that is protected, in plain terms — and where to read the current detail rather than a marketing summary of it.
The posture
Every record carries its organisation’s identity and every query is scoped to it at the framework layer, not by a check each feature has to remember. Cross-tenant access exists only through explicit, audited administrative tooling.
Each sensitive action maps to a named capability granted per member. The API enforces it and the interface only mirrors it, so hiding a button is never what keeps someone out.
Passwords and one-time codes are stored only as cryptographic hashes. One-time email codes protect signup, password reset and privileged logins, and the platform-owner console requires a second factor.
Payments run through Razorpay. Card details are handled entirely on their side and are not stored on our servers.
Append-only audit logs cover privileged actions, consent capture and rights-request handling — including who acted, and on whose behalf when a consultancy operates inside a client’s workspace.
The platform runs on infrastructure in India and every surface is served over TLS. Databases are backed up on a schedule and deployments are scripted rather than manual.
The authoritative version
The complete security page — including the current sub-processor table and the responsible-disclosure address — is served from the platform itself, where it is rendered from live configuration rather than copied into a marketing page. That is the version to read, and the version to send to a security reviewer.
What we do not claim
If you find a problem
If you believe you have found a security vulnerability, write to us with reproduction details. We acknowledge reports promptly, do not pursue good-faith researchers, and credit fixes where they are wanted. The disclosure address is on the full security page.
Send them to us before you buy rather than after. We would rather answer a hard question early.
