Security at Bilty

Every record carries your workspace ID, and every database query passes through a single access layer that adds it automatically. If that ID is missing, the query is refused instead of running unfiltered. One business cannot read another’s data.

• Passwords are stored only as argon2id hashes, never in plain text.
• Access tokens expire after 15 minutes and are kept in memory, not in browser storage.
• You stay signed in with an httpOnly refresh cookie that is replaced on every use. If an old one is ever reused, that session is signed out immediately.
• Email verification and password reset links are single-use and expire.

The Owner decides each user's role (Owner, Admin, Dispatcher or Accountant), and each role sees the screens and actions its job needs.

Links you send on WhatsApp use long random tokens, show only that one document, and can be revoked at any time. They expire after 180 days by default.

Card and UPI payments are processed by our payment gateway, Cashfree Payments. We never see or store your card number or UPI PIN.

• All traffic uses HTTPS.
• Support access to a workspace happens only when needed and is recorded in an audit log.
• The app and database are hosted in India.

If you find a vulnerability, email [email protected] with the steps to reproduce it. Please give us reasonable time to fix it before sharing it publicly, and do not access other customers’ data while testing.