Loading ChaiSaab
Getting your page ready...
Getting your page ready...
June 2026
This page describes how ChaiSaab protects your data. It is an overview — not a formal audit certificate or legal opinion. For privacy rights, see our Privacy Policy. Privacy Policy.
ChaiSaab is a shop commerce platform — orders, inventory, loyalty tokens, and chat. We are not a bank or wallet.
| Question | Answer |
|---|---|
| Are we SOC 2 certified? | Not yet for ChaiSaab itself. We run on AWS, which publishes independent SOC reports. |
| Is data encrypted? | Yes in transit (HTTPS / WSS). Sensitive data and most files use AES-256 at rest. |
| Are passwords safe? | Yes — one-way bcrypt hashing; we never store plain passwords. |
| Are payment gateway secrets safe? | Yes — encrypted in our database; keys live in secure server config. |
| Can I use passkeys? | Yes — optional passwordless sign-in with device biometrics or PIN. |
Formal certifications describe independent audit of controls — not a substitute for an audit report.
| Standard | ChaiSaab status | What it means for you |
|---|---|---|
| SOC 1 Type II | Not pursued | Not required today — we do not hold customer funds as a payment processor. |
| SOC 2 Type II | Not certified yet | On our roadmap if enterprise customers require it. |
| AWS SOC 2 / ISO 27001 | Inherited via AWS | Hosting and storage run on independently audited AWS services. |
| PCI DSS | Partial / delegated | Card payments go through gateways; we do not store card numbers or CVV. |
| Layer | Location & protection |
|---|---|
| Primary servers | AWS ap-south-1 (Mumbai, India). Encrypted disks. Secrets in AWS SSM. |
| Database | PostgreSQL on dedicated encrypted storage. |
| Files & media | Amazon S3 — shop media, private KYC, customer miniapp saves. |
| AWS SES — no India TRAI registration required for email. | |
| SMS | AWS SNS — India TRAI/DLT registration in progress. |
| Future regions | Japan, Thailand planned — regional privacy rules apply before local PII is stored there. |
| Measure | Status | Detail |
|---|---|---|
| Encryption in transit | Active | HTTPS for API; secure WebSockets (WSS) in production. |
| Encryption at rest | Active | Encrypted database disks; AES-256 for sensitive fields and key S3 objects. |
| Password storage | Active | bcrypt one-way hashing. |
| Gateway & MFA secrets | Active | AES-256-GCM in database; master key in secure server config. |
| Access control | Active | You see only your account data; shopkeepers see only their shop. |
| Retention | Active | Security logs kept at least 180 days. |
| Delete my account | Planned | Self-service account deletion and data export coming soon. |
| Control | Customers | Shopkeepers | Admins |
|---|---|---|---|
| Session tokens | Short-lived (15 min) + refresh | Same | Same |
| Cookie storage | httpOnly, Secure, SameSite | Same | Same |
| CSRF protection | On state-changing requests | Same | Same |
| Passkeys (WebAuthn) | Optional | Optional | Optional |
| Email verified at signup | Yes (email OTP) | Yes | Invite / setup flow |
| Phone SMS OTP at signup | Pending TRAI/DLT | Where enabled | — |
Live order updates, chat, and notifications use encrypted connections when you use HTTPS.
| Topic | How we protect it |
|---|---|
| Transport | WSS (TLS) in production — same encryption as the website. |
| Authentication | Same login token as the API; role-based rooms only. |
| Origin checks | Only allowed website origins can connect in production. |
We log token transfers and P2P activity on our servers — not anonymous cash-like transfers.
| Flow | Server audit | Notes |
|---|---|---|
| In-app token transfer | Yes | Amount, parties, and IP logged. |
| WebSocket chat relay | Yes | Messages subject to retention and takedown policy. |
| Offline order sync | Yes | Device syncs via HTTPS. |
| NFC / BLE offline tokens | Not offered | Blocked until compliance review complete. |
| Topic | How it works |
|---|---|
| Shop payment QR upload | Shop owner only; malware scanned on upload. |
| QR visibility | Public so customers can scan — your payment address, not an API secret. |
| Platform gateway keys | Encrypted in database; never shown in the UI after save. |
| Customer card data | Not stored by ChaiSaab — handled by payment gateways. |
| Purpose | |
|---|---|
| Privacy & data rights | privacy@chaisaab.com |
| Grievance & complaints | contact@chaisaab.com |
| Law enforcement (lawful orders) | legal@chaisaab.com |
| Security incidents | security@chaisaab.com |
June 2026 · v1.0
This page is an overview of security and compliance measures. It is not a SOC audit report or legal opinion.
© 2026 ChaiSaab Pvt Ltd. All rights reserved.