Security

1. What we protect

• Kaasa — your product catalogue, bills, GST records, customer and supplier khata, staff accounts, and the audio spoken at the counter while it is being turned into a bill.
• Kural — the phone numbers you call or that call you, call recordings and transcripts, the structured result of each call, and the agent scripts you approve.
• This website — what you send through the contact page, and your checkout session.

2. Encryption

On the device. Kaasa's local database is encrypted end to end with SQLCipher (AES-256). The key lives in the Android Keystore or Windows DPAPI, never in the app's files. Staff PINs are hashed with a per-member salt and never leave the device.

In transit. Every connection between the app, the website, our servers and our providers uses TLS. There is no unencrypted path.

At rest. Our Postgres database and file storage are encrypted at rest by the hosting provider. Backups are encrypted the same way.

3. Where data lives

Shop records, call records and account data are stored in a managed database in the Mumbai region (ap-south-1), on Indian soil. Call data for Kural stays in India.

One step may leave India: speech recognition. Where a speech provider processes audio on infrastructure outside India, the transfer is limited to the audio being processed, is bound by contract, and is made only to countries not restricted under the DPDP Act. Audio is not retained by default — see section 2 of the Privacy Policy.

4. Access control

• Row-level security. Every table that holds customer data is scoped by shop or company at the database layer. A query from one shop physically cannot return another shop's rows.
• Roles. In Kaasa, counter staff can bill; only the owner can see margins, change prices or read reports. In Kural, customers edit the safe settings of an agent; prompts are changed by us, with a version history and rollback.
• Entitlements are signed. What a plan allows is checked against a server-signed token, never a local flag.
• Our own staff. Administrative access is limited to the people who need it, is logged, and uses individual accounts.
• Secrets. Provider keys live only in server environment variables. They never reach a phone, a browser or the repository.

5. Backups and retention

• Backups. Daily, encrypted, stored in the same Indian region. Copies in backups age out within 30 days of a deletion.
• When you leave. Your data stays exportable for 90 days, then is deleted from live systems.
• Tax records. Where GST law requires invoice records to be kept, we keep only those, for up to 6 years.
• Voice samples. Not retained unless you opt in; 24 months at most if you do.
• Kural recordings and transcripts. Retention is set per customer in the console, with a default that is published on the plan.

6. Your rights under the DPDP Act

You can ask what we hold about you, correct it, or have it deleted. For Kaasa there is a delete-account page and an in-app button. For anything else, write to the grievance officer:

• Name: Kishan, Founder & Grievance Officer
• Email: privacy@vektorlabs.in
• Phone: +91 90432 60810

We acknowledge within 72 hours and resolve within 30 days.

7. Who else touches your data

Each is bound by contract to process data only on our instructions. We do not sell personal data and we do not share it with advertisers.

8. If something goes wrong

If we find or are told about a personal data breach, we contain it first, then notify the Data Protection Board of India and the people affected as the DPDP Act requires, and tell you plainly what happened and what we changed. A Kaasa shop keeps billing throughout: the local database on your phone does not depend on our servers.

9. Responsible disclosure

If you find a weakness in Kaasa, Kural or this website, write to security@vektorlabs.in with enough detail for us to reproduce it. We reply within 72 hours, fix confirmed issues as a priority, and credit you if you want to be credited. We do not take action against researchers who act in good faith, avoid other people's data, and give us reasonable time to fix the issue before publishing.