Security at BizGST Pro

Your invoices, khata and business data are sensitive. Here is exactly how we protect them — every item below is actually implemented in the product, not marketing language.

1. Encryption

• In transit: all traffic is forced over HTTPS/TLS (HSTS enabled, 1-year max-age).
• At rest: the database (PostgreSQL on Supabase, Mumbai region) encrypts data at rest.
• Passwords: hashed with bcrypt via Supabase Auth — we never see or store plain passwords.

2. Tenant Isolation

Every table is protected by PostgreSQL Row-Level Security (RLS) with deny-by-default policies. Your company's rows are cryptographically scoped to your authenticated session — another customer's query physically cannot return your data, even if application code had a bug.

3. Access Control

• Five roles — Owner > Admin > Accountant > Sales > Viewer — enforced at the database policy level, not just the UI.
• CA Partner access is read-only, granted only via an access code you generate, and revocable by you at any time.
• The platform admin area is restricted by a server-side email allowlist, enforced at both middleware and API layers.

4. Abuse & Attack Prevention

• Cloudflare Turnstile CAPTCHA on signup/login (blocks bots without tracking you).
• IP rate limiting on authentication (brute-force protection) and on AI endpoints (burst + daily quotas).
• OWASP security headers: CSP, X-Frame-Options (clickjacking), nosniff, strict referrer policy.
• Password policy enforced at registration.

5. Audit Trail

Sensitive actions are written to an append-only audit log that users cannot modify or delete — role changes and critical events remain traceable.

6. Secrets & Keys

API keys (AI, payments) exist only in server-side environment variables — they are never shipped to the browser. Payment credentials are handled entirely by Razorpay (PCI-DSS compliant); we never store card or UPI details.

7. Backups & Data Location

Primary data is stored in the Mumbai (ap-south-1) region, India, with provider-managed backups. You can export your data (CSV) anytime — no lock-in.

8. Responsible Disclosure

Found a vulnerability? Email support@bizgstpro.com with subject "SECURITY". We acknowledge within 48 hours, will not pursue good-faith researchers, and credit reporters (with permission) after a fix ships.