At BillAstra, the security of your business and financial data is a core priority. This page summarises the measures we take to keep your data safe and how you can report a security concern.
1. Encryption
- All traffic between your device and BillAstra is encrypted in transit using TLS (HTTPS).
- Passwords are never stored in plain text — they are hashed using a strong, industry-standard algorithm.
- Sensitive credentials and tokens are stored in encrypted form.
2. Access Controls
- Each business workspace is isolated, and access is governed by role-based permissions you control.
- We follow the principle of least privilege for internal access to production systems.
- Administrative access to infrastructure is restricted and logged.
3. Payments
Payments are processed by our PCI-DSS compliant payment partner (Razorpay). BillAstra does not store your full card number, UPI PIN, or other sensitive payment credentials on its servers.
4. Backups & Reliability
- We perform regular automated backups of your data to support recovery in the event of an incident.
- Our infrastructure is hosted with reputable providers offering robust physical and network security.
5. Monitoring
We monitor our systems for suspicious activity, apply security updates promptly, and rate-limit sensitive endpoints to protect against abuse and brute-force attempts.
6. Your Role in Security
You can help keep your account safe by:
- Using a strong, unique password and not sharing it.
- Limiting team access to only those who need it, with appropriate roles.
- Signing out on shared devices and reporting anything suspicious.
7. Reporting a Vulnerability
We welcome responsible disclosure. If you believe you have found a security vulnerability in BillAstra, please email hello@example.com with the details. We ask that you give us a reasonable opportunity to investigate and address the issue before any public disclosure, and that you avoid accessing or modifying data that is not your own.