We take the security of your business data seriously. Here is a high-level summary of how we protect it -- for the full technical detail, contact us directly.
Encrypted transport
All traffic to and from Vimarsh is encrypted in transit via HTTPS/TLS. Session cookies are marked secure and httpOnly and are never accessible to page scripts.
Tenant isolation
Every query is scoped to your own organization in application code, and Postgres row-level security adds a second layer on the routes that read or write your business data, so a query that forgets its scope still cannot read another organization's rows there -- one customer's data is never visible to another.
Authenticated access
Passwords are hashed (never stored in plain text) and checked against known data-breach corpora at signup. Sensitive account actions, like deleting your account, require re-entering your password even within an active session.
Payments
All payment processing is handled directly by Razorpay, a PCI-DSS compliant payment gateway. We never see or store your full card, UPI, or bank details.
Third-party connections
Google Search Console, Google Ads and Meta Ads connect via each provider's own standard OAuth consent screen -- Vimarsh only ever requests read-only access, and the access token we receive is encrypted at rest with a key dedicated to that connector. ChatGPT Ads uses an API key you provide directly, encrypted the same way. Disconnecting any of these revokes access at the provider where supported and permanently deletes the stored credential immediately.
Reporting a security issue
If you believe you've found a security vulnerability in Vimarsh, please report it responsibly to [email protected] rather than disclosing it publicly. We will acknowledge your report and keep you updated as we investigate.