Security policy

• Least privilege by default: no one at SaathiX reads customer data unless a support ticket authorises it.
• Encrypt everything at rest and in transit.
• Log everything so we can audit later.
• Fail closed, alert loudly.

• Data at rest: AES-256 on database and object storage.
• Data in transit: TLS 1.2 and 1.3 with modern cipher suites.
• Backups: encrypted with a separate key managed in a hardware security module.

All customer data is hosted in India on an enterprise cloud with ISO 27001 and SOC 2 certified data centres. We do not replicate data outside India.

• Role based access inside your account: Owner, Manager, Cashier, Accountant.
• PIN and biometric unlock for cashiers on shared devices.
• Optional IP allowlist for the Owner role.
• Employee access at SaathiX requires MFA and is logged.

Automated backups run every 24 hours with a 30 day point in time restore. Restores are tested quarterly. Business continuity target: RPO 24 hours, RTO 4 hours.

• 24x7 platform monitoring with automated alerts.
• Security incidents are triaged within 1 hour.
• Affected owners are notified within 72 hours as required by the DPDP Act.

Found something concerning? Please email security@saathix.com with steps to reproduce. We acknowledge within 24 hours and coordinate a fix. Please do not publicly disclose before we confirm the fix has shipped.

SaathiX secures the platform. You secure your account: use strong passwords, rotate PINs when staff leave, and review the audit log inside Settings monthly.