How your shop's data is kept safe.

01 · Separate shops

Every shop stays separate

Every record in BillCountr belongs to one shop, and every request is checked against the shop of the person making it. That check happens on the server, not just on the screen, and reports, exports and syncing phones work inside the same boundary.

• Bills, stock and customers belong to one shop
• Checked on the server for every request
• Reports and exports stay inside it
• Each phone is registered to one shop

02 · Signing in

Who is signed in, and for how long

Passwords are stored as salted hashes, never as text. Each person is signed in on one device at a time; signing in on a new one, changing the password, or the owner switching the account off all end the old session. Sign-in and code requests are rate-limited, so a password cannot be guessed at speed.

• Passwords stored as salted hashes
• One signed-in device per person
• Switching staff off ends their access
• Sign-in attempts are rate-limited

03 · Roles

Hiding a button is not the protection

What each person can see and do is decided by their role, and the server checks it on every action, so a hidden button is never the only thing in the way. A feature your shop has switched off is blocked the same way.

• Owner, manager, cashier and auditor rolesBusiness
• Decide exactly what each role can doBusiness
• Switched-off features are blocked on the server
• A refused action says so in plain words

04 · Record of changes

Changes leave a record nobody can delete

Important changes, like a bill cancelled, a price changed or a customer edited, are recorded with who made them, when, and what the value was before. The record cannot be edited or deleted, by staff or by the owner, on every plan. Reading it as an activity log is part of Business.

• Who made the change, and when
• What it was before, where it matters
• Cancellations and reversals kept in order
• The activity log, to read and reviewBusiness

05 · In transit

Protected on the way, and on the phone

Everything between the app and our servers travels encrypted over HTTPS, and your shop's data is kept on servers in Mumbai. On the phone, the sign-in is kept in Android's secure storage. Database queries are built so that nothing anyone types into BillCountr can change what a query does.

• Encrypted in transit over HTTPS
• Kept on servers in Mumbai, India
• Sign-in kept in the phone's secure storage
• Queries protected against injection
• Pictures uploaded through short-lived signed links

06 · Our staff

What BillCountr's own staff can see

To run the service, BillCountr staff can see a shop's account details: the shop, the people and phones on it, its plan and its bills from us, and whether its phones are syncing. They can also end a person's sessions, switch off a person or a phone, and suspend or close a shop's account. Each of these is written to an audit log they cannot change. Your bills, stock and customers are different: to see those, a support person needs a grant that records who, why and until when. It lasts at most 4 hours, can be ended early, and a view-only grant cannot change anything in the shop.

07 · Corrections

A mistake is corrected, not hidden

A saved bill is never rewritten. Cancelling marks it cancelled and reverses its stock and udhaar as new entries, so the history still reads in the order it happened.