Encrypted in transit
The site is served over HTTPS through Cloudflare.
Security
How this site and your data are handled
What's actually in place, and what isn't.
Passwords hashed
Passwords are stored as salted scrypt hashes, never in plain text. You can also sign in with Google.
Form protection
Forms use anti-forgery tokens, and sign-in and other sensitive actions are rate limited.
Safe site checks
The free check refuses private and internal addresses and limits redirects, size and time.
Payments by Razorpay
Card and UPI details go to Razorpay, not to this site. Payments are verified with a cryptographic signature.
Your data stays yours
Each client sees only their own sites, tickets, invoices and reports. Ask any time to export or delete your data.
What isn't in place
No independent security audit has been done and there is no uptime SLA. Two-factor login is optional: turn it on in your dashboard under Security (authenticator app plus recovery codes). Found a problem? Email hello@nirvayo.com.