Security

How we protect your data

• Encryption in transit: the app, paizy.in and our API only talk over HTTPS (TLS).
• Encryption of sensitive fields: your PAN and full credit bureau responses are encrypted with AES-256-GCM by our servers before they are stored.
• Verified sign-in: sign-in is handled by Supabase Auth. Every request to our servers carries a signed token that we verify before returning any data, and you can only reach your own data.
• Secure storage on your phone: the app keeps your sign-in session in the device’s secure storage (Keychain on iOS, Keystore on Android).
• A locked-down database: row-level security is switched on for our application tables, so apps and browsers cannot read them directly. Only our servers can.
• Limited team access: only authorised team members can use our admin tools, with access based on their role, and admin and other sensitive actions are recorded in an audit log.
• Abuse limits: Paizy AI has a daily message limit, our public endpoints are rate-limited, and the waitlist form has bot protection.
• Guardrails on Paizy AI: it can read only your own account data, cannot move money or change your account, and does not receive your name, phone number, email address or PAN from our systems.
• No card numbers: Paizy does not store card numbers.
• Careful monitoring: our error monitoring is set up not to send personal data by default.

What you can do

• Never share your password or one-time code (OTP) with anyone. Paizy will never ask for them, by phone, SMS, email, WhatsApp, social media or in Paizy AI.
• Use a strong password that you do not use anywhere else.
• Lock your phone with a PIN, password or biometrics, and keep its software up to date.
• Install the Paizy app only from the official links on paizy.in, and check that websites asking you to sign in are on paizy.in.
• Do not type passwords, codes or card numbers into Paizy AI.
• Sign out when you use Paizy on a shared device.

Spotting scams

Paizy will never ask you to send money to “verify” your account, pay a fee to unlock credit, or install a screen-sharing or remote-access app. The Paizy Credit Card, Credit Line and UPI payments are not live yet, so anyone offering them to you today is not Paizy.

If you think someone has accessed your account, change your password and email hello@paizy.in with the subject “Security”. Tell us what happened and when.

Reporting a vulnerability

If you find a security problem in Paizy, email hello@paizy.in with the subject “Security”. Please include:

• what the problem is and what it could let an attacker do;
• the steps to reproduce it, and the affected URL, endpoint or app version;
• any proof of concept, screenshots or logs; and
• how we can reach you.

We will acknowledge your report, keep you updated while we investigate, and tell you when it is fixed. We do not run a paid bug bounty at the moment, but we are glad to credit you if you would like.

Responsible disclosure

When researching Paizy, please:

• test only with accounts you own or have permission to use;
• stop and report to us as soon as you can see someone else’s data, and do not keep, share or change it;
• give us reasonable time to fix the problem before telling anyone else about it.

Please do not:

• access, change or delete other people’s data;
• run denial-of-service attacks, spam, or high-volume automated scans;
• use phishing or social engineering against our team or users, or attempt physical access;
• test services run by other companies that Paizy uses, such as our hosting or authentication providers. Report problems in those services to the company concerned.

If you act in good faith and follow these guidelines, we will not take legal action against you for your research.

If something goes wrong

If a personal data breach affects you, we will tell you and the Data Protection Board of India as the DPDP Act requires, and report cyber security incidents to CERT-In as Indian law requires. We will explain what happened, what it means for you and what you can do.

Contact

Security reports and account concerns: hello@paizy.in, subject “Security”. Questions about your data: see our Privacy Policy.