Start free trial

Security

Munafa Book keeps each business's data separate, stores it in India, encrypts it in transit, protects every login with a PIN and lockout, and lets you download a full backup any time.

Your data

  • Stored on cloud servers in India (Mumbai region).
  • Every connection uses HTTPS encryption.
  • Each business's data is kept separate; every request is checked to belong to your business, and this is tested on every release.
  • A backup copy of every business every night, kept 30 days, plus the database's own point-in-time backups. Restoring is practised on a separate test copy.
  • Your own backup download at any time, on any plan.

Logins

  • Login with mobile number and a 4–6 digit PIN, stored only as a one-way hash.
  • Too many wrong PINs lock the login for a few minutes.
  • The app can lock itself after a period without use.
  • See every signed-in device and log one out from PIN & security.
  • One-time codes by email for signup, forgotten PINs and deleting a business.
  • Limits on how often anyone can try to log in, ask for codes or sign up, from one phone number or internet address.
  • The website only runs its own code plus Razorpay's checkout and the analytics script (Content Security Policy).

Staff

  • Roles: salesmen cannot see buying prices or profit; accountants can only view.
  • Every change is recorded with who made it, in the activity log.
  • Turn a person off and their phone is signed out.

Payments

Plan payments are handled by Razorpay. We never see or store your card details or UPI PIN.

Who processes your data

  • MongoDB Atlas (database, Mumbai, India): all business data.
  • Our application server: runs the app; keeps no business data of its own.
  • Encrypted object storage (Cloudflare R2 or Amazon S3): the nightly backup files, deleted after 30 days.
  • Razorpay (India): plan payments.
  • Email provider: one-time codes, receipts and notices (your email address and the message).
  • Error monitoring (Sentry): error messages with names, phone numbers and emails removed.
  • None of them may use your data for anything else.

Monitoring

  • The app and its database are checked every few minutes from outside; see the status page.
  • Errors are reported to us straight away, and we get a daily summary of payments, errors and backups.

Report a problem

If you think you found a security issue, please tell us privately: email info@munafabook.com.