Trust

Security

Last updated 29 October 2026

Your customers trust you with their messages. Here is how Phalsa protects them.

Accounts and access

• Passwords are stored only as scrypt hashes — nobody at Phalsa can see them.
• Repeated wrong passwords are slowed down. Password reset links work once and expire after 30 minutes.
• Changing or resetting a password logs out every other device.
• The Phalsa team has its own separate login with a private Member ID. Team members can open a business’s dashboard only to help it, and every visit is recorded in a security log kept for a year.

Your data

• All traffic is encrypted with HTTPS through Cloudflare.
• Every business’s data is kept separate; one business can never see another’s.
• WhatsApp access tokens and other secrets are encrypted at rest with AES-256-GCM.
• Messages from WhatsApp and payment notices from Razorpay are only accepted with a valid signature.
• Card and bank details never touch Phalsa — Razorpay handles them.
• The database is backed up every day, and old chats are deleted automatically after the period each business chooses.

The website and dashboard

• A strict Content Security Policy only lets Phalsa’s own code run on our pages.
• Cookies are HttpOnly, SameSite and Secure over HTTPS; requests that change data must come from our own pages.
• We don’t use advertising or tracking scripts.

You stay in control

• Download everything we hold for your business at any time.
• Erase a single customer when they ask, or close your account and delete everything.
• Choose how long chats are kept.

Report a problem

Found a security issue? Please email hello@phalsa.ai with “Security” in the subject. We’ll reply within 2 working days, keep you updated, and won’t take action against good-faith research that avoids harming users or their data.