- Home
- Security
Security you can ask hard questions about
What is built into the product, what depends on your configuration, and what is still to be confirmed. We state capabilities plainly and do not claim certifications we do not hold.
| Time | User | Action | Record |
|---|---|---|---|
| 11:42 | Cashier 1 | Login | Counter PC |
| 11:58 | Pharmacist | Edit | INV-0138 discount |
| 12:20 | Owner | Delete | PUR-0377 line |
| 13:05 | Accountant | Export | GSTR-1 (Excel) |
Sample data for illustration
Security capabilities at a glance
Each item shows its status. Anything marked To be confirmed or Roadmap is not a promise of availability.
Encryption in transit and at rest
Traffic between your devices and Curafisc is encrypted with TLS. Stored data is encrypted at rest in the cloud service.
Role-based access
Per-module permissions for owner, pharmacist, cashier, accountant and branch roles. Sensitive screens such as purchase rates and reports can be hidden by role.
Audit trail and activity log
Edits and deletions of bills, rates and stock entries are recorded with user and time.
Automated backups and restore
Cloud data is backed up automatically each day. Restore is available on request. Retention period: [To be confirmed]
Session and device controls
Password policy, session timeout and sign-out of lost devices. Two-factor authentication: Roadmap
Offline-mode data protection
The planned Windows desktop app (Roadmap) is intended to keep its offline data protected on the device and sync securely when connected. Local encryption details: [To be confirmed]
Data residency in India
Production data is intended to be hosted in India. Hosting provider and region: [To be confirmed]
Least-privilege internal access
Curafisc staff access to customer data is limited to support need and logged. Policy details: [To be confirmed]
What you control, what we control
Security is shared. Curafisc secures the platform. You decide who in your team can do what.
| Area | Curafisc | Your business |
|---|---|---|
| Platform & hosting | Operates, patches and backs up | Uses supported browsers and devices |
| User access | Provides roles and logs | Assigns roles, removes leavers |
| Credentials | Enforces password rules | Keeps passwords private, no sharing |
| Data accuracy | Provides tools and audit trail | Entered data and statutory filings |
| Local devices | Protects app data | Device security, OS updates |
Aligned with the DPDP Act, 2023 approach
Curafisc treats customers of your pharmacy as data principals. This section describes our approach; it is not legal advice. Legal review pending.
Data principal rights
Processes to support access, correction and erasure requests raised through you or directly. Procedure [To be confirmed]
Consent and purpose
Collect only what is needed for billing, dues and prescriptions, with purpose stated. Consent templates [To be confirmed]
Grievance officer
Name and contact: [Grievance officer to be named]. Response timelines [To be confirmed].
See the Privacy Policy template. Health-related data you enter, such as prescription details, should be handled per your own obligations.
Found a vulnerability?
We welcome good-faith reports. Please email [security@ address to be confirmed] with steps to reproduce. Do not access data that is not yours or disrupt the service. We will acknowledge within [target time] and keep you updated. No bug bounty is offered at this time [Owner to confirm].
Security contacts
Security: [admin@curafisc.com?]
Grievance officer: [To be confirmed]
Phone: [To be confirmed]
Where we are, honestly
These are intentions, not claims. No certification is held unless listed as achieved here.
| Item | Status | Notes |
|---|---|---|
| Independent penetration test | [Status] | Owner to confirm whether done or planned |
| ISO/IEC 27001 alignment | Roadmap [To be confirmed] | Not certified. Planned timeline to be confirmed. |
| SOC 2 report | [Status] | Not held. Owner to decide if planned. |
| DPDP Act processes | In progress | Consent, rights handling, grievance officer |
| Two-factor authentication | Roadmap | Planned for admin users |
| SSO for enterprise | Roadmap | Planned for enterprise plans |
Questions IT and procurement teams ask
Is my data encrypted?
Data is encrypted in transit with TLS and at rest in the cloud service. Specific algorithms and key management details are [To be confirmed].
Where is data stored?
Intended to be hosted in India: [Hosting provider and region].
How often is data backed up?
Automatically, daily. Retention and restore time objectives are [To be confirmed].
Can I see who changed a bill?
Yes. The activity log records edits and deletions with user and time.
Can I restrict what cashiers see?
Yes. Permissions are per module, so cashiers can be limited to billing.
Do you have SOC 2 or ISO 27001?
No certification is claimed. See the roadmap above.
What happens to my data if I leave?
You can export your data. Retention and deletion periods after termination are [To be confirmed]. See Terms.
Can we get a security questionnaire answered?
Yes, request it via the contact form. Responses will only state confirmed facts.
See Curafisc on your own data
Book a guided demo or join the early-access list. We will help you load a sample of your items and bills so you can judge the software on your real workflow.