pagar karo
Security
Attendance, salaries and bank details are sensitive. This is how we protect them, and how to tell us if you find a weakness.
How your data is protected
- Every business's data is kept apart: each request is checked against the businesses you belong to, and automated tests try to cross that line on every page and API.
- Roles decide who sees what — for example, bank details and salaries only for the people you allow — and the server checks this on every request, not just the menus.
- Bank account numbers, PAN and Aadhaar are encrypted in the database; screens show only the last four digits unless you may see more.
- Changes to money, attendance, access and personal data are recorded in an audit log with who, when and from where.
- Sign-in by one-time code or password, with limits on attempts; you can see and sign out your sessions and apps at any time. The platform team signs in with two-step codes.
- Connections are encrypted (HTTPS). Files such as selfies and documents are private and opened only through signed links.
- Support can open your business only after the owner grants access, for a limited time, and everything they open is in your audit log.
Reporting a vulnerability
Contact us through your account's support channel and ask for the security team.
- We reply within 3 working days and keep you informed until it is fixed.
- Please give us reasonable time to fix it before telling anyone else.
- Test only with your own account and business. Do not access, change or delete other people's data, do not disrupt the service (no load or denial-of-service tests), and do not use social engineering or physical attacks.
- If you follow these rules in good faith, we will not take legal action against you for your research.