Security and data protection

• Deployed on cloud servers in India (Mumbai region), with daily backups.
• Each customer’s data is kept logically separate; one customer can never see another’s.

• Role-based access: each user sees and does only what their role allows.
• Maker–checker approvals with amount limits.
• Optional two-factor login with an authenticator app.
• Automatic logout after a period of inactivity.
• Accounts lock after repeated wrong passwords.

• All traffic is served over HTTPS (TLS 1.2 or later).
• Sensitive personal fields (PAN, bank account, mobile number) are encrypted in the database with AES-256-GCM.
• Full Aadhaar numbers are never stored.

Every change is logged with who made it, when, from where, and the values before and after.

Posted accounting entries cannot be edited or deleted; they can only be reversed by a new entry.

Customers own their data. On request we provide a complete export, and when a contract ends we return the data and then delete it as agreed in the contract.

We collect only the personal data the service needs, use it only for that purpose, and log access to it, in line with India’s Digital Personal Data Protection Act, 2023. Details of what this website collects are in our privacy policy.

• Every change is code-reviewed before release.
• Automated tests run on every change.
• Dependencies are scanned for known vulnerabilities in our CI pipeline.
• Security headers are set on our applications.

Where a customer contract requires it, a security audit by a CERT-In empanelled auditor is carried out before government go-live.

If you find a security issue in our website or products, email contact@trakshym.com. We acknowledge reports within 2 working days.

While testing, please do not access or change other people’s data, and do not disrupt the service. Our contact details are also published in /.well-known/security.txt.