How we protect your books

The service runs on managed cloud infrastructure in India, in data centres with their own physical security and compliance programmes. Production systems sit in a private network; administrative access needs multi-factor authentication and is granted to the smallest number of people who need it.

• All traffic uses TLS 1.2 or better. Plain HTTP is redirected, never served.
• Data at rest, including database backups and uploaded files, is encrypted with AES-256.
• Passwords are stored only as bcrypt hashes with a per-password salt. We cannot read your password, and neither can anyone who obtains the database.

Inside your account, you decide who sees what. Roles are defined per company and permissions are checked on the server for every request — hiding a button is not a permission.

Signing in gives your browser a short-lived session that renews itself in the background and is tied to that browser — a session copied off one computer does not work on another. Changing your password, or choosing to sign out everywhere, ends every other session at once.

Repeated sign-in attempts are slowed down and then blocked. Password reset links are single-use and expire in 30 minutes. Signing in with Google never gives us your Google password.

• One account can run several businesses. Each has its own staff, roles, data and settings.
• Every request says which business it is for. Someone who is not a member of that business is refused, and a record from one business is never served to another — not even to the same owner in the wrong tab.
• The Super Admin of a business cannot be removed, renamed or stripped of access, so a business can never be locked out of itself.

Our staff do not browse customer records. Access to production data is limited to a small on-call group, requires a reason, and is logged. When you ask for support that needs us to look at a record, we look at that record and nothing else.

• Full daily backups with continuous write-ahead logging for point-in-time recovery.
• A 35-day recovery window; restores are rehearsed, not assumed to work.
• Backups are encrypted and stored separately from the production database.
• Your own export is always available in the product, so recovery is never solely in our hands.

• We build for 99.9% monthly uptime, and schedule maintenance in advance.
• Every request is rate-limited, so one misbehaving client cannot slow everyone else down.
• When part of the system is failing, the app stops retrying and tells you plainly, instead of freezing or piling more load on.
• Errors never show you our internals. You get a plain sentence and a reference number we can trace on our side.

• Changes are reviewed before they merge, and dependencies are patched on a schedule.
• Money paths — invoicing, ledgers, stock movement — are covered by automated tests.
• Staging and production are separate; we do not develop against live customer data.
• Errors are monitored, and secrets are held in a managed store rather than in code.

We investigate suspected incidents immediately. If a breach affects your data, we will tell you what happened, what was affected and what we are doing about it — within 72 hours of confirming it, and before we are comfortable, not after. Status and post-incident notes go to the account holder’s email.

Send findings to info@techbizsolution.co.in with enough detail to reproduce. We acknowledge within two working days and keep you updated until it is closed.

• Test only against your own account, never another customer’s data.
• No denial-of-service testing, spam or social engineering of our staff.
• Give us reasonable time to fix an issue before publishing it. We will not pursue researchers who follow these rules.