Security & Privacy
Security, by design
How we protect your business data.
Security Architecture
- Local Storage
- AES-256 encrypted Hive database
- Backup
- Optional Supabase cloud sync with TLS 1.3
- Auth
- OTP via SMS + biometric secondary
- Network
- All API calls over HTTPS only
- Data Retention
- User-controlled - delete anytime
Protection
How your data is protected
AES-256 Encryption
Local database encrypted with bank-grade AES-256 via the Android Keystore hardware module. The encryption key never leaves your device.
No SMS Access
UPI detection uses Android's NotificationListenerService and never requests READ_SMS or RECEIVE_SMS permissions. Your personal messages are never read.
Biometric Lock
Fingerprint or face unlock protection for the app on shared devices. Auto-locks after 30 seconds in the background.
Offline Architecture
Data lives on your device first - cloud is secondary and optional. Your business records are never transmitted without your explicit consent.
OTP Authentication
Phone-number-based OTP login - no passwords to steal or forget. PINs are hashed with bcrypt (cost factor 10) and never stored in plain text.
Zero Data Sales
We never sell, rent, or trade user data to third parties. Your business records are yours - we earn nothing from your data.
Architecture
Data we never collect
These are never requested and never used. You can verify this in your Android app settings under Permissions.
- Contacts or address book
- SMS messages
- Payment amounts from SMS
- Location data
- Call logs
Camera and photos: only when you scan
The camera and photo access are used only for the optional ledger scan, and only when you start a scan. The photo is sent securely for text extraction (Microsoft Azure Computer Vision or OCR.space) and deleted immediately after. See the permissions we request
Responsible Disclosure
Found a security issue?
Please report security vulnerabilities privately before any public disclosure. Email us at security@hisabexpert.com
We acknowledge all reports within 24 hours and commit to resolving critical issues within 7 days. Good-faith researchers are protected from legal action.
Report an issue