Security

Built so trust is checkable

Your books, payroll and customer conversations live here. These are the architectural facts that protect them — facts, not promises.

Tenant isolation in the database

Every table carries Postgres row-level security keyed to your workspace, with restrictive policies generated from one permission registry. Isolation is enforced by the database engine itself — an application bug cannot read another tenant's rows, because the query never sees them.

One device per login

Signing in on a new device signs the old one out, atomically, checked on every request. Accounts cannot be shared, and a stolen session dies the moment the real owner signs in.

Role-based access on every module

Permissions are per-module and per-action, enforced in the database through the same policy layer as tenant isolation. An employee restricted to attendance punch-in cannot reach payroll data by knowing a URL.

Append-only audit trails

Sign-ins, device displacements, plan changes and every administrative action are logged to tables where UPDATE and DELETE are revoked at the database level. The log cannot be edited by the people it describes — including us using the admin console.

Payments never touch our servers

Checkout runs on Razorpay (PCI-DSS Level 1) via Daylink Tech Labs Private Limited. Card numbers are entered on Razorpay's systems; we receive a signed confirmation and independently verify the captured amount against the order before any plan changes.

Secrets stay server-side

Payment credentials live only on the payment hub, integration tokens are encrypted at rest, and our own admin console displays whether a secret is configured — never its value, not even masked.

Stated limits

Two-factor authentication (TOTP) is in development and listed on the public roadmap; until it ships, account security rests on password strength plus the single-device rule. We publish what is not built yet for the same reason we publish what competitors do better: a security page that overclaims is worse than none. Security questions go to support@dailybiz.in, and reports of vulnerabilities are answered personally and fast.

See it from the inside

Roles, audit logs and session control are all visible in the trial — fourteen days, no card.

Start free trial