This page describes the technical and organisational measures Rebota uses to protect your account, project data and payment information. For how we collect and use personal data, see our Privacy Policy; for our processor commitments to business customers, see our Data Processing Agreement.
1. Encryption
- In transit: every page is served over HTTPS, with HTTP requests redirected automatically and HSTS enabled so browsers only ever connect over TLS.
- At rest: sensitive fields — vendor bank account numbers, IFSC codes, PAN, and worker wage bank details — are encrypted with AES-256-GCM before being stored, using a server-side key that never leaves the application.
- Passwords: account passwords are never stored in readable form — only a bcrypt hash is kept, so even we cannot see your password.
2. Access Control
- Role-based permissions (Owner / PM / Engineer / Viewer) govern what each team member can see and change on a project.
- Every mutating request is checked against the session and a per-session CSRF token, in addition to the role check.
- Login attempts and password-reset requests are rate-limited per account and per IP address to slow down credential-stuffing and brute-force attempts.
- Sessions use HttpOnly, SameSite, and — on HTTPS — Secure cookies, so session identifiers are not accessible to page scripts.
3. Payments
Card, UPI and net-banking details are handled entirely by our payment partner, Razorpay (PCI-DSS Level 1 certified) — Rebota's servers never receive or store your card number, CVV or UPI PIN. Every payment is verified server-side using an HMAC signature before a subscription is activated.
4. Monitoring & Audit
- Security-relevant actions (logins, record changes) are written to an audit trail so activity on a project can be traced back to a user and timestamp.
- Login attempts are logged for a minimum of 180 days to support abuse investigation.
- See our System Status page for a live check of the web application and database.
5. Data Hosting & Location
Application data is hosted with an India-based data centre, so customer data stays within India. See our Data Retention Policy for how long different categories of data are kept, including the statutory retention periods that apply to financial and GST-linked records.
6. Reporting a Security Issue
If you believe you've found a security vulnerability in Rebota, please report it responsibly to the contact below before any public disclosure. We will acknowledge reports within 2 business days.