Security

Can another firm see my data?

No. Every record in Biztricks belongs to exactly one workspace, and every query the application makes is bound to the workspace of the person making the request. Nothing in the product asks the caller which firm's data it wants.

Support tooling does need to read across workspaces, and that is where most multi-tenant leaks come from — one convenient bypass, copied into a second place, and then a third. So there is exactly one sanctioned path that may cross the boundary, and an automated check runs over the whole codebase on every build and fails it if any other code tries. The rule is enforced by the build rather than by somebody remembering it at review time.

What protects my account?

• Passwords are stored as one-way hashes, never in a readable form. Nobody at Vedatricks can look up your password, and neither can we recover it for you — we can only let you set a new one.
• Sign-in attempts are rate-limited, as are password-reset and email-verification requests.
• Sessions are cookie-based and host-scoped, so a session for the application is not valid anywhere else.
• Traffic is encrypted in transit over HTTPS.
• Email addresses are verified before a new workspace can be used.

Who in my firm can see what?

You decide, screen by screen. Someone you invite starts with leads, clients and quotes — the pipeline, not the money. The item list, invoices and reports are the commercially sensitive surfaces and are granted per person.

Two abilities are treated as privileges rather than screens, and both start switched off for everybody but the owner: reopening a quotation a customer is already holding, and deactivating a record so it disappears from everyone's pickers. New privileges always start denied — nobody gains an ability because we shipped one.

Cost prices and margins can additionally be blurred on screen, so a customer looking over a shoulder on site does not read them.

How safe is a share link?

A share link carries a long random token, not a document number, so links cannot be guessed or walked through in sequence. The request is rate-limited. Shared documents are served with instructions telling search engines not to index them.

What a share link deliberately does not do is ask for a password — that is the point of it. Anyone holding the link can read the document, including anyone your customer forwards it to, until you revoke it. Revocation is immediate and complete. Treat a share link the way you would treat a PDF you emailed.

What happens to my payment details?

They never reach us. Payment runs through Razorpay: your card details go to them, and Biztricks receives a reference and a success or failure. There is no card number in our database to be stolen.

Payment notifications from Razorpay are verified cryptographically against a shared secret before Biztricks acts on them, and each one is processed exactly once even if it is delivered twice.

What we do not have

Stated plainly, because a security page that lists only what exists is one you cannot make a decision from.

• No two-factor authentication for workspace users yet. A password is currently the whole wall on a normal account.
• No single sign-on, SAML or directory integration.
• No customer-managed encryption keys.
• No published penetration-test report or third-party certification. Vedatricks is a small company and we would rather say that than imply an audit that has not happened.
• No contractual uptime guarantee. See the terms.

Reporting a vulnerability

If you have found something, tell us at support@vedatricks.com with enough detail to reproduce it. We will acknowledge you, work on it, and keep you informed. Please give us a reasonable chance to fix it before publishing, and please do not access, change or delete data belonging to anyone else while investigating — a report is welcome, a breach of someone's workspace is not.

If something goes wrong

If a security incident affects your data we will tell you and the relevant authority promptly, with what we know at the time and what we are doing about it. We will not wait until the story is tidy.