Security

This page describes, in plain language, the real measures CareYourBusiness takes to keep your business's data separate from every other business on the platform, and to keep your account secure. It's not a compliance certificate -- it's a straightforward account of what's actually built, so you can decide for yourself whether it's enough for your business.

Tenant isolation, enforced by the database itself

CareYourBusiness is a multi-tenant platform -- every business runs on the same shared application and database. The separation between businesses isn't just a rule our application code follows; it's enforced directly by Postgres's own Row-Level Security, at the database layer. Every table that holds a business's data -- products, orders, customers, pages, and everything else -- carries a database-level policy that only ever returns rows belonging to the business making the request. Even a bug in our own application code that forgot to filter by business would still be blocked by the database itself, not just by our code remembering to check.

The one exception is the small set of tools our own platform staff use to operate the service (for example, resolving a support request) -- these use a separate, narrowly-scoped internal role, and every use is recorded in an audit log tied to the staff member who made it.

Account security

• Passwords are never stored in plain text -- only a secure, industry-standard hash.
• Sign-in is also available via a one-time code sent to your email, with no password involved at all.
• Roles within your own business (Owner, Admin, Staff) control who on your team can change settings, manage billing, or just view day-to-day orders and bookings.

Payments

Card and payment details are handled entirely by our payment processor (Razorpay) -- they never pass through or get stored on our own servers. Keeping card data out of our systems entirely is a deliberate design choice, not an afterthought.

Data in transit

Every connection to CareYourBusiness -- your admin panel, your storefront, and your customers checking out -- is encrypted (HTTPS), including on a custom domain you connect to your site.

Backups

Your data is backed up automatically on a regular schedule by our database provider, independent of anything your team does day to day.

Reporting a concern

If you believe you've found a security issue, please contact us directly rather than testing it against another business's live data -- we take reports seriously and will follow up promptly.