Security & Trust | DragBizz

Core security measures

Encrypted in transit and at rest

All data transmitted to and from DragBizz is encrypted using TLS 1.3. All data stored on our servers is encrypted at rest using AES-256.

Authentication and sessions

JWT-based session management with configurable timeout. Passwords are hashed using bcrypt with salt. We recommend enabling two-factor authentication (2FA).

Secure API design

All DragBizz APIs use HTTPS-only endpoints. API keys are scoped with minimum-privilege defaults. Rate limiting and abuse detection protect against misuse.

Infrastructure security

DragBizz runs on cloud infrastructure in India. Production and development environments are fully isolated. Access to production systems is strictly role-gated.

Data isolation

Each retailer's data is logically isolated in our database layer. No retailer can access another retailer's inventory, customers, or financial records.

Audit logs

DragBizz maintains detailed audit logs of all sensitive actions within the platform, including logins, invoice modifications, and data exports.

01Payment Security

DragBizz does not store, transmit, or process raw payment card data. All subscription payments and POS payment collections are handled by Razorpay, which is:

PCI-DSS Level 1 certified — the highest level of payment security compliance
RBI-licensed payment aggregator
Responsible for all card tokenisation and transaction security

02Third-Party Integrations

DragBizz integrates with external services (WhatsApp, Amazon, Flipkart, Shiprocket, etc.). When you connect a third-party integration:

We store only the minimum access credentials required (e.g. API keys, OAuth tokens).
Credentials are encrypted and stored in our secrets management system.
You can disconnect and revoke any integration at any time from your dashboard.
We recommend rotating API keys periodically for maximum security.

See the current list on our integrations page.

03Compliance

DragBizz aligns with Indian regulations governing digital data and GST handling:

Regulation	Method
IT Act 2000	Data processing complies with all provisions.
DPDPA (India)	Aligns with Digital Personal Data Protection Act 2023.
GST Act	GSTN-compliant IRN/E-way bill standardisation.
RBI Guidelines	Complies via Tier-1 payment partners like Razorpay.

04Responsible Disclosure

We take vulnerability reports seriously. If you discover a security issue, please report it responsibly to our security team at support@dragbizz.io.

Please include a description, steps to reproduce, and impact. We acknowledge most reports within 48 hours.

Found a security issue?

DragBizz ·

support@dragbizz.io

Related policies