BizPilotSecurity at BizPilot
Where your data lives
- Stored in a managed PostgreSQL database in India.
- Encrypted at rest (AES-256) and in transit (TLS 1.2+). The website forces secure HTTPS connections.
- Automatic daily backups, encrypted.
Who can see it
- Every record is tied to one company. Row-level security in the database itself checks, on every request, that you're a member of that company. A mistake in the app can't expose another company's data.
- Roles inside each company: owner, admin, accountant, staff and view-only.
- Our team does not access your books unless you ask for help, and access is limited to what's needed.
Signing in
- Passwords are stored only as secure hashes.
- Optional two-step verification with an authenticator app. We recommend it for every owner.
- Sign out of all other devices from Security settings.
Every change is recorded
A permanent activity log records who created, changed or deleted each invoice, payment and setting, with before-and-after values. Nobody can edit or delete it, including us through the app. Deleted entries are kept as history rather than erased.
Payments
Subscriptions are handled by Razorpay, a PCI-DSS compliant payment gateway. We never see or store card or UPI details. Every payment notification is verified with a cryptographic signature.
Shared invoices
Invoice links use long random codes, show only that one document, expire automatically, and are hidden from search engines.
Web protections
Strict security headers (Content Security Policy, HSTS, clickjacking protection) and Cloudflare's network protection.
If something goes wrong
We have an incident response plan. We'll inform affected customers and report to CERT-In and the Data Protection Board of India within the timelines the law requires.
Report a vulnerability
Found a security issue? Email with details. Please don't access other people's data. We'll respond quickly and credit you if you wish.