How Nivasta keeps your data safe
What protects your society's accounts, bills and payments, in plain words.
Last updated:
HTTPS only in productionPasswords and codes stored as hashesShort-lived sign-in tokensNo card details on our servers
Sign-in
- Passwords are stored with bcrypt, a slow one-way hash made for passwords. We cannot read them.
- One-time codes (OTP) by SMS expire after 2 minutes, allow 3 tries, and are limited to 5 SMS per hour for one number. Only a hash of the code is stored.
- Lock-out: after 5 wrong passwords an account is locked for 15 minutes.
- Tokens: the app gets a 15-minute access token and a 30-day refresh token. The refresh token is replaced every time it is used. If an old one is used again, we end every session for that login.
- On your phone: the refresh token sits in the Android Keystore or iOS Keychain. The app can also ask for a PIN or fingerprint, and locks itself after a minute in the background.
Payments
- Payments are made on Razorpay's own checkout. Card numbers, UPI PINs and bank logins never reach Nivasta.
- A bill is marked paid only after a valid Razorpay signature (from the checkout or from the signed webhook), never because the app says so.
- Each payment is processed once, and the amount is checked against the order.
- Payment gateway secrets saved by Miracurl or a society are encrypted with AES-256-GCM, and are never shown again after saving.
Data and servers
- In production Nivasta is served over HTTPS only. The server refuses to start in production with development secrets.
- Each society's data is separated by society, and every request is checked against the signed-in person's role: resident, society admin or Miracurl.
- Error messages never include stack traces, file paths or database text.
- The database schema is changed only through reviewed migration scripts.
- Security headers (content security policy, no framing) are on for every response.
What we ask of you
- Never share your OTP, password or PIN. Nivasta staff will never ask for them.
- Society admins: remove residents who have moved out, and use a strong password.
- Keep your phone updated and locked.
Found a security problem? Please tell us at before you tell anyone else. Include what you found and how to repeat it. We will reply and look into it.
How we handle your personal data is in the Privacy policy.