This page describes the technical and organisational measures GSTIVITY uses to protect customer data. It is maintained by Bizzgyaan Private Limited as an editable statement of our current practices, and is not an independent certification or audit report.
1. Hosting & platform
The application runs on a modern edge/serverless runtime with globally distributed infrastructure. Our database, authentication and file storage are provided by a managed Postgres platform hosted in secured data centres.
2. Encryption
- In transit: TLS 1.2+ for all client-server traffic.
- At rest: AES-256 encryption for the managed database and object storage.
- Secrets: API keys and service credentials are stored in an encrypted secrets vault; never in source code.
3. Authentication
Passwords are hashed using industry-standard algorithms. Sessions use short-lived JWT access tokens with rotating refresh tokens. Users can change their password from the account menu at any time.
4. Tenant isolation (multi-user confidentiality)
Every user-data table enforces row-level security policies scoped toauth.uid(). This means a user can only read/write rows they own. Administrators can manage subscription status but cannot query or export another user's matters, notices, drafts, uploads or diary entries.
5. Role-based access
Administrative roles are stored in a dedicated user_roles table validated via a security-definer function — never on the profile record — to prevent privilege escalation.
6. AI processing safeguards
Prompts are transmitted over TLS to our AI gateway. We do not permit foundation model providers to retain your inputs for training. Sensitive fields (client identifiers) should be redacted by the user where not required for the analysis.
7. Backups & recovery
The managed database is backed up automatically with point-in-time recovery. Backups inherit the same encryption and access controls as production data.
8. Logging & monitoring
Application and platform logs capture authentication events, server function errors and admin actions. Logs are retained for operational troubleshooting and are access-controlled.
9. Vulnerability management
We follow a continuous-dependency-scanning approach and patch known vulnerabilities on a risk-prioritised basis. Please report suspected vulnerabilities responsibly to bizzgyaan@gmail.com — please do not publicly disclose before we have had a reasonable opportunity to remediate.
10. Incident response
In the event of a personal data breach that is likely to cause harm, we will notify affected users and, where applicable, the Data Protection Board of India in accordance with the DPDP Act, 2023 and the CERT-In Directions, 2022.
11. Shared responsibility
Security is a shared responsibility. Users must protect their credentials, avoid sharing accounts, keep devices secure, and only upload data they are authorised to process.
12. Contact
Security & privacy queries: bizzgyaan@gmail.com · +91 90340 71639.