Security
How SARAJOD protects voice transactions, bill scans, udhar ledgers, and account data with encryption, app lock, and responsible disclosure.
Last updated:
Financial data deserves serious protection. This page summarizes how SARAJOD approaches security for voice expenses, bill scans, udhar ledgers, and shared profiles — and how to report a concern.
- Privacy-first design — collect the minimum data needed for each feature.
- Defense in depth — layered controls across app, API, and infrastructure.
- Least privilege — internal access limited to what operations require.
- Transparency — clear policies and a direct channel for security reports.
- Encryption in transit — all API traffic uses TLS (HTTPS).
- Encryption at rest — sensitive data stored on our servers is encrypted where applicable.
- On-device protection — master PIN, optional biometric unlock (Face ID / fingerprint), and secure storage for session tokens on supported platforms.
- Offline-first sync — local database on device with background sync; designed to reduce data loss when connectivity is poor.
- Phone OTP sign-in with time-limited codes.
- Access and refresh tokens for authenticated API calls.
- Ability to review active sessions from Profile settings.
- App lock with PIN after sign-in on supported builds.
- Voice audio is processed to create transactions you can review before saving.
- Bill images are processed for extraction; images are handled under the same security standards as other account data.
- Approval workflows for shared profiles reduce unauthorized ledger changes.
- Production systems hosted on reputable cloud infrastructure with network isolation.
- Secrets and credentials managed outside application code.
- Monitoring and logging for abuse, errors, and operational incidents.
- Regular dependency updates and security patches as part of our release process.
Profiles, collections, and operator roles (viewer vs editor) let you limit who can add, edit, or delete transactions. Review permissions before inviting collaborators.
Our app listings disclose data collection practices (account info, financial info, contacts, photos, audio, device identifiers) in line with Google Play Data safety and Apple privacy nutrition labels. See our Privacy Policy for full detail.
If you believe you have found a security vulnerability, please report it to [email protected] with a description, steps to reproduce, and impact assessment. Please do not publicly disclose issues before we have had a reasonable time to investigate. We appreciate responsible researchers and will acknowledge valid reports.
If we confirm a breach affecting your personal data, we will investigate promptly and notify affected users and regulators where required by law.
Security FAQ
SARAJOD encrypts data in transit and at rest on our infrastructure and uses on-device security for app lock and tokens. End-to-end encryption in the strict sense (where only you hold the keys) is not claimed for all server-stored ledger sync today. We design so your data is not accessible to other users without your permission.
Sign in on a new device with OTP, review active sessions in Profile, and change your master PIN. Contact [email protected] if you suspect unauthorized access.