Your firm runs on client data — financial details, PAN/GST numbers, documents. Protecting it is foundational, not an afterthought. Here is how we keep it safe.
Encryption
- In transit: all traffic between your browser and the application is encrypted over HTTPS (TLS, 256-bit).
- At rest: the database and stored documents are encrypted at rest.
- Passwords are never stored in plain text — they are stored as salted one-way hashes and cannot be read by us.
Per-firm isolation
Every firm (organisation) is identified by its own organisation code, and the application scopes every request to the signed-in user's organisation. One firm cannot see or reach another firm's data. Sessions are protected with signed tokens (JWT) that expire.
Access control
- Role-based access: Owner, Admin, Manager, Team Member and Trainee, each with different permissions.
- Configurable permissions: the firm's owner decides exactly what each role can do — for example restricting a trainee to only their own tasks, or keeping fees and financial reports owner-only.
- Sensitive money controls (fees, payment edits, revenue reports) default to the owner.
Audit trail
Key actions are logged with the user and timestamp, so there is an accountable record of who changed what and when.
Backups & availability
The application is hosted on reputable cloud infrastructure with regular backups. We target high availability and monitor the service so we can respond quickly to issues.
Document sharing
When you share a document, you can generate a single-file link that expires on your terms, rather than exposing your whole vault.
Operational practices
- Production secrets (keys, credentials) are kept out of source code and restricted to the running server.
- Changes are version-controlled and deployed through a repeatable process with health checks.
- Access to production systems is limited to those who need it.
Responsible disclosure
If you believe you have found a security issue, please tell us privately so we can fix it. Email support@smartcabuddy.com with details. We appreciate responsible disclosure and will respond promptly.
At a glance
• 256-bit encryption in transit & at rest • Per-firm data isolation
• Role-based, configurable access • Audit trail on key actions
• Hashed passwords • Expiring document links • Regular backups
For how we handle personal data and your rights, see our Privacy Policy.
Security is an ongoing process; this page describes our current practices and will be updated as they evolve.