Data Security

AI never changes your data on its own

Voice and AI features only propose an action. The proposal is checked by our server rules (stock, permissions, amounts) and shown to you. Only when you tap Confirm does the server record it, through the same validated process used for manual entries. The AI has no direct access to your database.

Separation between businesses

• Every record belongs to exactly one business, and every request is checked on the server against the signed-in user’s business and role.
• Branches and staff only see what their role allows. Staff can be prevented from seeing profit, costs or reports.

Accounts and access

• Passwords are stored only as strong one-way hashes — nobody, including us, can read them.
• Sessions use secure, HttpOnly cookies and can be revoked; password resets sign you out everywhere.
• Login and sensitive endpoints are rate limited, and cross-site request forgery is blocked.
• Platform support access is restricted to authorised staff and every action is logged.

Correct, tamper-evident records

• Money is stored as exact whole paise and quantities as exact units — no rounding drift.
• Each entry is saved atomically: a sale, its stock change and the customer balance are recorded together or not at all.
• The database itself refuses changes that would make stock negative by mistake.
• Duplicate submissions (double taps, retries, offline sync) are detected and recorded only once.
• Mistakes are corrected by reversal, not deletion, and every change is written to an audit log showing who, when and how.

Infrastructure

• The Service runs on Cloudflare’s global network with encryption in transit (HTTPS/TLS).
• The database supports point-in-time recovery, so data can be restored to an earlier moment if something goes wrong.
• Offline entries are kept on your device only until they sync, and cached data is cleared when you log out.

What you can do

• Use a strong, unique password and don’t share logins — give each staff member their own account.
• Remove staff access as soon as someone leaves.
• Keep your phone locked and your browser up to date.

Reporting a vulnerability

Found a security issue? Please report it by email at support@suvakta.com or through our contact form. See our Acceptable Use Policy for responsible disclosure guidelines.