Authority · MeitY
DPDP Act 2023
Any member can export their own data and the Owner can export the company’s. The Owner can ask for the company to be deleted, with 30 days to cancel.
Export and deletion requestTrust
What protects your books, and where to check it.
Your BOQs, vendor bank details, payroll and tax records sit in Rebaar. This page lists each protection, the standard it follows, and its status today. If something is not done yet, it says so.
- AES-256-GCM on stored credentials
- Authenticator app and passkeys
- SAML and OIDC single sign-on
- Signed webhooks
- Activity log kept 8 years minimum
Compliance and law
The rules we follow, and who sets them
Each card names the authority and says plainly where we stand.
Authority · CERT-In
CERT-In Directions 2022
Our incident procedure reports incidents on CERT-In’s list within 6 hours. The activity log is kept in India for at least 8 years, well beyond the 180 days required.
Procedure in placeAuthority · Companies Act §128
Business records
While your company is on Rebaar, no retention setting removes its invoices or tax records, and the activity log that explains them is kept at least 8 years. Deleting the company deletes its records too, so export them first.
EnforcedAuthority · NIC, through your GSP
GST e-Invoice and e-Way Bill
Generated under your GSTIN with your own credentials, which are stored encrypted. Rebaar is not itself a GSP.
Your credentialsAuthority · PCI-DSS
Card payments
Subscription payments go through a PCI-DSS certified payment processor. Card numbers never reach Rebaar.
Handled by processorAuthority · CERT-In empanelled auditor
Independent penetration test
Not yet conducted. When it is done, this card will show the month.
PlannedDefence in depth
Six layers between a stranger and your data
Signing in
- Passwords hashed with bcrypt
- Authenticator app codes and passkeys; a company can require them for everyone
- A sign-in from a new device in a new country, on an account without an authenticator, waits for a code sent to its email
- Every sign-in alert carries a “This wasn’t me” link that signs out every device
- On the web, the password is not checked until the human check on the email step has passed
Dangerous actions
- New API keys, single sign-on changes and account deletion ask you to prove it is you again
- People without an authenticator or passkey confirm with a code sent to their email
Company separation
- Every database query is limited to your company
- Automated tests fail the build if a route that changes data skips sign-in, or could link a record to another company
Roles and permissions
- 14 built-in roles, from Site Engineer to Accountant
- Custom roles; one person can hold several
- Amounts on invoices, vendors and purchase orders can be hidden from roles that should not see money
Data at rest and in transit
- All traffic over TLS; browsers are told to use HTTPS only, for two years
- GST, messaging, accounting and single sign-on credentials encrypted before they are stored
- Each uploaded file is tied to the person who uploaded it; download links expire in 5 minutes
API and webhooks
- API keys stored as hashes, with read or write scope, an optional IP allow-list and an end date
- Every webhook is signed so you can check it came from Rebaar
- Webhook addresses pointing inside private networks are refused
For your IT team
The security questionnaire, already filled in
One row per control: the standard, how Rebaar applies it, and its status.
| Control | Standard | How Rebaar applies it | Status |
|---|---|---|---|
| Transport | TLS · HSTS 2 years, preload | HTTPS only; browsers are told never to use plain HTTP for this site | Live |
| Passwords | bcrypt, cost 12 | An older, weaker hash is replaced the next time the person signs in | Live |
| Second factor | TOTP (RFC 6238) · WebAuthn passkeys | Optional per person; a company can make it compulsory for everyone | Live |
| Risky sign-in | New device + new country | On an account without an authenticator, the sign-in waits for a code sent to its email | Live |
| Bot check | Human check before the password | On the web sign-in, the password is not checked until the human check on the email step has passed | New |
| Dangerous actions | Step-up re-authentication | Creating or revoking API keys, changing single sign-on, deleting a custom role or an account, and every refund or support session by our staff ask for an authenticator code, a passkey, or a code sent to email | New |
| Single sign-on | SAML 2.0 · OIDC with PKCE | A domain must be proved in DNS before sign-on is enforced for it | Live |
| User provisioning | SCIM 2.0 | Tokens stored hashed; a deactivated person keeps their work history | Live |
| Company separation | Every query filtered by company | Automated tests fail the build when a route that changes data skips sign-in, or could link a record to another company | Live |
| Stored credentials | AES-256-GCM | A fresh random IV per value; covers GST, messaging, accounting, single sign-on and webhook secrets | Live |
| Uploaded files | Signed upload receipt | Each file is tied to the person who uploaded it; download links expire after 5 minutes | Live |
| Webhook signing | HMAC-SHA256 (Standard Webhooks) | Signed with an ID and timestamp; addresses inside private networks are refused at every delivery | Live |
| API keys | SHA-256 hash · read / write scope | Optional IP allow-list; every new key has an end date, one year by default and two at most | New |
| Activity log | Who · what · when · device · address | Changes, sign-ins, exports and any support session by our staff | New |
| Log retention | 8 years minimum | Kept forever by default; an Owner cannot set less than 8 years | New |
| Server error log | 180 days | Kept in the database in India, with passwords, tokens and keys removed before it is written | New |
| Backups | Daily off-site copy · point-in-time restore | The database can be restored to a point in time, and a daily copy is kept away from the database host | Live |
| Independent test | CERT-In empanelled VAPT | Web app, public API and mobile sign-in. Not done yet | Planned |
| Certification | ISO 27001 · SOC 2 | Not held. We will not claim either before an auditor issues a report | Not held |
Live in productionNew added October 2026Planned not done yet
Log retention
Your activity log outlives the problem
Every company has an activity log: sign-ins and failed sign-ins, role changes, approvals, money movements, exports, and any support session by our staff. Each entry records who, what and when, and the device and network address it came from. It is kept forever by default and never for less than 8 years.
Breaches are usually found months after they happen. A short log would erase the evidence before anyone looked.
Questions about your data go to [email protected]. The privacy policy explains how requests are handled.
Reporting a vulnerability
Found a hole? Tell us first.
Send a description, steps to reproduce and the impact. We respond within 1 business day and update you within 5 business days with our assessment. We do not pursue legal action against good-faith research.
Please do
- Give us reasonable time to fix before going public (90 days is standard)
- Send enough detail for us to reproduce it
- Use a test company, never a real customer’s data
Please do not
- Run automated scanners against production — they hit our rate limits and block real users
- Read, change or delete data that is not yours
- Run denial-of-service tests
- Social-engineer Rebaar staff or customers
Acknowledgments. We credit researchers by name, with their consent. The list is empty for now. Reward: no paid bug bounty. We credit valid reports publicly (with consent) and may offer a free year of the Growth plan as thanks. Machine-readable policy: /.well-known/security.txt
Questions buyers ask
Straight answers
Where is our data stored?
Your database is stored in India, in a Bengaluru data centre.
Can Rebaar staff see our data?
Only through a support session. Starting one asks the staff member to prove who they are again, a banner shows for as long as it lasts, and it is written to your activity log where your Owner can read it.
What if one of our API keys leaks?
Revoke or rotate it in Settings. Rotation can give the old key a grace period of up to 7 days so integrations keep running. A key can also be limited to your office IP range, and every new key has an end date.
How do we know a webhook really came from Rebaar?
Each delivery carries an HMAC-SHA256 signature, an ID and a timestamp, in the Standard Webhooks format. Compute the same signature with your webhook secret and reject anything older than five minutes.
How long is the activity log kept?
Forever by default. An Owner can choose a shorter period, but never less than 8 years. Each entry records who did what and when, and the device and network address it came from.
Can we export or delete our data?
Any member can export their own data, and the Owner can export the company’s. The Owner can also ask for the company to be deleted; the request waits 30 days so it can be cancelled. Tax records the law requires us to keep for 8 years are kept.
Are you ISO 27001 certified or penetration tested?
No. Neither has been done. A penetration test by a CERT-In empanelled firm is planned, and this page will show the month it happens.
Doing security diligence?
Send us your questionnaire. We answer it and take a 30-minute call with your IT team.