Security

How we protect your shop data.

Last updated: 2026-10-15

Tukzo runs your shop's livelihood. The platform is built with a small set of controls that we actually have in place today — listed below. Compliance certifications (ISO 27001, SOC 2, PCI-DSS) are not yet in place; we'll publish them on this page only after each audit is signed off.

Authentication & access

• Sign-in uses short-lived session tokens that are refreshed automatically.
• Passwords are hashed with bcrypt — never stored in plain text.
• Mobile numbers are verified by OTP when you register.
• Role-based access for staff — each person sees only what their role allows.

Data handling

• All traffic is encrypted over HTTPS.
• Each shop's data is kept in its own account, separate from other shops.
• Customer phone numbers stay in your shop's account. We never sell them.

Payments

• UPI payments are requested for the exact bill amount.
• Settlement tracking links each payout back to the bills it paid.

Resilience

• Databases are backed up regularly.
• Services run in versioned containers, so a release can be rolled back.

Data protection rights (DPDP Act 2023)

See our DPDP notice for your rights as a Data Principal, our retention windows, breach-notification policy, and the contact details of our Data Protection Officer.

Report a security issue

If you believe you've found a security vulnerability, please reach us at tukzoudi@gmail.com. We reply during office hours.