Security

Account protection

• OTP sign-in with expiry, retry limits, rate limiting and temporary lockouts.
• Short-lived sessions in secure, HttpOnly, SameSite cookies, with refresh-token rotation and theft detection.
• Alerts when your account is used from a new device, and one-click sign-out of all sessions.

Vehicle privacy

• Challans are shown only for vehicles verified against registration records.
• Limits and monitoring prevent automated scanning of registration numbers.
• Owner names returned by sources are encrypted at rest and only ever displayed masked.

Payments

• Payments happen on a regulated gateway’s hosted page. We never see or store card numbers, CVV or UPI PINs.
• The amount is always verified with the source on our servers — never taken from your browser.
• Signed, replay-protected payment notifications and duplicate-payment protection.

Infrastructure

• TLS everywhere, encryption at rest, secrets held in a managed secrets vault.
• Multi-factor authentication and role-based access for staff, with a complete audit trail.

Found a vulnerability? Please email support@example.com with the subject “Security”.