Security & your data

You are putting your customer list, your prices and your receivables into someone else’s software. This page is the straight answer to what that means: who can see what, how access is controlled, what BizOS support can and cannot do in your account, and how you get your data back out.

Isolation between businesses

Your business is a tenant. Every customer, invoice, job, message and setting carries its tenant, and every read and write is filtered by it. This isn’t a UI convention — it’s enforced in the data layer on every request, and it’s covered by tests that exist specifically to catch a query that forgot it.

Uploaded files (logos, job photos, receipts) are stored under keys that include your tenant, so even a leaked file URL can only ever expose one business’s media. If you own several businesses, each is its own tenant and nothing is shared between them except your login.

Signing in

Sign-in is a 6-digit OTP sent by SMS to a +91 number. There is no password to reuse, phish or leak.

• Codes are valid for 10 minutes.
• At most 3 codes per hour per number.
• 5 wrong attempts invalidates the code, and the lockout is recorded in the activity log.
• Codes are stored hashed, never in plain text.

Sessions are per device and can be revoked. Signing out clears any locally cached catalogue on that device, so the next person to use that browser starts clean. Deactivating a team member signs them out of your business at once.

Access inside your business

Every member holds one of six fixed roles — Owner, Admin, Manager, Accountant, Office staff, Field technician — that mean the same thing in every business and cannot be edited. Three consequences worth stating plainly:

• A screen or button a role can’t use isn’t shown, and the server refuses the action anyway.
• Money a role may not see is never sent to it — revenue cards, cost prices and other people’s cash are stripped on the server, not just hidden.
• Only the Owner and Admins can change roles, business settings, integrations, API keys or the plan. No other role can be given those.

A Field technician sees only the jobs assigned to them, and with Branches staff can be limited to some branches. See Team & roles.

Your customers’ consent

BizOS messages your customers on your behalf, so consent is enforced by the system rather than left to whoever writes the automation:

• WhatsApp opt-out is set automatically when a customer replies STOP, or manually from their record. Every customer-facing send checks it, including messages to contacts who are not customers.
• Email opt-out is set by the one-click unsubscribe in any BizOS email, by a bounce or complaint, or manually.
• Ads opt-out: a customer or lead marked “Exclude from Facebook audiences” is never uploaded to a Facebook custom audience, and neither is anyone who opted out of marketing.
• Quiet hours: a workflow’s wait step never releases a customer message between 21:00 and 09:00 IST; it holds it until morning.
• Automatic customer updates are off by default and switched on per event.

Payments

Payment links are created against your own Razorpay account — there is no platform account in the middle, and money settles directly to you. Webhooks are verified against your own signing secret, resolved from the invoice rather than trusted from the incoming payload. Your gateway secret is write-only: once saved, the interface confirms it exists but never shows it back. A branch with its own Razorpay account has its secrets stored encrypted, and a link is always cancelled and verified with the account that made it.

Third-party tokens and private content

• Meta tokens (the Facebook connection for Lead Ads and ad audiences) are stored encrypted, and Meta Lead Ads webhooks are checked against Meta’s signature before anything is created.
• Ask BizOS conversations are stored encrypted and blanked after 90 days. The assistant acts only as the member who asked, with that member’s access. See Ask BizOS.

How does BizOS support access my account?

Many owners would rather BizOS support simply fixes the setting for them, so a support session can make changes:

• A session is started with a stated reason (and optionally a ticket number) by a BizOS support admin, and lasts 30 minutes by default, 60 at most.
• It is either Make changes (the default) or View only. A view-only session cannot change anything; the block is on the server, not just the screen.
• Every change appears in your Activity log as “BizOS support”, never as you. On our side, each change is logged too (the address and result only, never the content you saved).
• The session sees only the business it is helping — never your other businesses.

Even in a Make changes session, support cannot:

Support identities are entirely separate from customer accounts. A support login cannot become a member of your business, and your login cannot reach the support console.

Getting your data out

Your data is yours and there is no exit tax:

• Accounting exports — a full range of sales invoices, GST splits, receipts and party masters as Tally XML or Zoho Books CSVs, per GSTIN.
• Reports — CSV of any report, over any date range.
• Activity log — CSV export of the change history.
• Customer, item and lead lists are exportable from their screens.

Deleting data

• Archiving is the normal action for items, categories, price lists, suppliers, branches and custom fields — the record leaves your working views and history stays readable.
• Deactivating is the normal action for people, so their work stays attributed.
• Deleting an issued invoice is limited to the Owner, Admin and Manager (“cancel and correct mistakes”), takes its payments with it, and is refused once the invoice has reached Tally or has a credit note — raise a credit note instead. Every deletion is in the activity log.
• Hard deletion also exists where it should: a draft document, and a custom field purge that strips its values from every record.

API keys and webhooks

An API key is stored only as a hash and shown once. It acts as a separate, permission-scoped member of your business that cannot sign in, hold a seat or reach team, roles, settings, billing, exports, imports or the Assistant; every change it makes is attributed to it by name in the activity log. A key can be tied to one branch. Keys are rate-limited and can be revoked in seconds. Webhook deliveries are HMAC-signed with a per-endpoint secret over the timestamp and body, target only public HTTPS hosts, never follow redirects, and carry ids rather than full records.