Security & Compliance
Eight architectural mechanisms implemented in code rather than promised in a policy brochure. Each one is verifiable and something you can ask us to demonstrate.
Tenant separation is enforced by PostgreSQL row-level security with restrictive policies, so a query that forgets to filter by tenant returns nothing rather than another business’s records. It is an engine-level guarantee, not a convention the application is trusted to follow.
Protects your business from statutory penalties up to ₹250 Crores with unbundled customer consent tracking, role-scoped customer list export controls, encrypted KYC vaults, and automated harmonization with 6-year GST invoice retention mandates.
Not optional and not a setting an owner can switch off for convenience. Sign-in is a code to a registered phone; the counter then unlocks with a PIN for the rest of the shift, so speed at the till does not cost you the second factor.
Branch scope comes from the cryptographically signed session token, and assignment is mandatory rather than defaulted. A salesperson at one counter cannot read another branch’s stock, margins, or bills.
Who may discount, who may write off, who may see cost prices or export customer directories — checked in the API, not only hidden in the interface. A hidden button is not a security boundary.
Who did what, and when, including the actions nobody wants to have to ask about. Documents are append-only: a correction raises a credit or debit note rather than rewriting what was handed to a customer.
The desktop app keeps an encrypted local replica with encryption keys anchored to the operating system credential vault. A stolen counter machine or cloned hard drive yields only ciphertext, not your customer phonebook or ledger.
No credentials, tokens or environment values in client bundles. Customer PAN and financial identifiers are masked and excluded from log lines by automated architectural policy and review.
No certification badges. Vowerole does not currently hold an external audit or certification, and claiming one it does not have would be the least defensible thing on a security page. When there is one, it will be named here with its scope and its date.
Found something? Write to tech@vowerole.com and it gets read the same day.
Start on the free trial, or book a walkthrough and we will set the first branch up with you.
