How we protect your data

1. Isolation between businesses and branches

Many lending businesses share the platform, so every record is separated along four axes, checked on the server for every request:

2. Encryption

• In transit: all traffic between browsers, the Android app and our servers uses HTTPS (TLS 1.2 or 1.3), with HTTP Strict Transport Security (HSTS) enabled.
• Sensitive fields: Aadhaar numbers and integration credentials (bureau, KYC and payment-gateway keys) are encrypted in the database with AES-256-GCM. Aadhaar numbers are shown masked.
• Passwords: stored only as salted bcrypt hashes; nobody, including our staff, can read them.

3. Access control & approvals

• Role-based access: field agents record collections and register customers; they cannot change loan terms or see the business's accounts.
• Maker-checker approvals: customers registered or edited by field agents, loan edits and collection corrections go to an admin for approval, with a before/after view.
• Audit trail: approval requests record who raised and who decided them, and when; penalty waiver requests must include a reason.
• Login protection: sign-in and verification endpoints are rate-limited to slow down password guessing.

4. The ZoloFund Android app

• App lock: optional fingerprint / face unlock using Android's biometric system. Biometric data stays on the phone.
• Login tokens: kept in Android Keystore-backed secure storage.
• Location: used only while the app is open, to stamp collections and visits. See the Privacy Policy for every permission.
• Camera & photos: KYC and collateral photos are uploaded to your business's account; they are not saved to the phone gallery by the app.

5. Backups

• The full database is backed up automatically every day and backups are kept for 30 days.
• Backup files are readable only by the server administrator account.

6. Hosting & data residency

• The application and database run on a virtual private server operated by Hostinger International Ltd in Mumbai, India.
• Subscription payments are processed by Razorpay, a PCI-DSS certified payment gateway. We never see or store card numbers.
• Other service providers (KYC, credit bureaus, messaging, push notifications) are listed in the Privacy Policy.

7. Security incidents

If we find a security incident affecting personal data, we contain it, inform the affected businesses without undue delay, and report it to CERT-In and the Data Protection Board of India as Indian law requires.

8. Reporting a vulnerability

If you find a security problem, please tell us privately before sharing it publicly. We will not take legal action against anyone who reports in good faith without accessing or changing customer data.