Data security

• No password to steal. Riders sign in with a six-digit passcode sent to their phone. There is no rider password anywhere in our system, so there is none to leak, guess or reuse from another site.
• Passcodes are single-use and short-lived. Each expires five minutes after it is issued and stops working once used.
• Guessing is capped. After five wrong attempts a code is dead and a new one must be requested. Repeated requests from the same number or network are throttled.
• Codes are unpredictable. They are generated from cryptographic randomness, not from a clock or a counter that could be worked out.
• The code itself is never stored. Only a one-way hash of it reaches the database.

• Two factors, always. Every staff account requires an emailed identity, a password and a time-based code from an authenticator app. Two-factor authentication is mandatory, not optional.
• Passwords are hashed with scrypt, a memory-hard function tuned so that each attempt costs roughly 32MB of memory and a tenth of a second. That is what makes working through a stolen table expensive rather than trivial. Every password gets its own random salt.
• Second-factor secrets are encrypted at rest with AES-256-GCM, using a key held in the environment and never written beside the data it protects.
• Accounts lock themselves. Five failed sign-ins lock the account for fifteen minutes.
• Wrong email and wrong password take the same time to fail, so the response cannot be used to discover which staff emails exist.

• A session token is 32 bytes of cryptographic randomness. Only its SHA-256 hash is stored. Someone holding a copy of our database still cannot sign in as you.
• Rider sessions last 60 days; staff sessions last 12 hours. Staff are deliberately shorter because a console session reaches many riders’ records.
• Signing out revokes the session immediately. Lose your phone, tell us, and we revoke it for you.

There are six roles (rider, support agent, emergency agent, store operator, finance officer and administrator) and each is granted named capabilities rather than access to tables.

• A rider can reach only their own records.
• A support agent can work tickets but cannot approve a refund.
• A store operator can move stock but cannot adjust a points balance.
• A finance officer can reconcile payments but cannot change a rider’s documents.

Every request is authorised on the server. Hiding a button is not a permission.

Each entry records who acted, in what role, on what, when, and the before and after values. If a points balance or a refund is ever questioned, the record settles it.

Card numbers, CVVs, PINs and banking credentials are entered on Khalti’s own screens and never pass through our systems. We store the gateway’s transaction reference and its result, and each reference is unique, so a replayed confirmation cannot create a second payment against the same transaction. Every payment is confirmed by an independent server-to-server check with the gateway, never on the strength of a callback alone.

• All traffic is served over HTTPS.
• The application, database and uploaded documents run on Amazon Web Services in the Mumbai region, the closest to Nepal, with encryption at rest and daily automated backups.
• Documents you upload are held in private storage. They are not on a public URL; the application issues a short-lived signed link each time one is opened.
• Development, testing and production are separate environments with separate data.

Being straight about this matters more than sounding impressive:

• We hold no security certification: no ISO 27001, no SOC 2. We are not going to imply otherwise.
• Independent security testing, backup-restoration testing and user-acceptance testing are required to pass before the platform opens to riders. Until they have, this page describes the design and the code, not a completed audit.
• No system is perfectly secure. If something goes wrong we will tell affected riders what happened, what was involved and what to do.

• Never share a passcode. We will never ask you for one.
• Keep a screen lock on the phone your account signs in from.
• Tell us the same day if your phone is lost or stolen.
• Treat any message asking for your passcode, PIN or bank details as fraud, whoever it claims to be from.

If you find a vulnerability, tell us before you tell anyone else and we will work with you. Reach us on 9712604900 or WhatsApp. Please do not access, alter or keep anyone else’s data while demonstrating a problem.

What we collect and how long we keep it is on the privacy policy.