How we protect your record
Plain answers, no security theater. (Deeper detail lives in our internal security standards; this page covers what affects you.)
Encryption.
TLS in transit; encryption at rest on Azure. Journal encryption adds a client-side layer we cannot open.
Your data is fenced.
Every database query is scoped to your account — tenant isolation is enforced in one shared code path and tested on every feature. Requests for someone else's data return “not found,” revealing nothing.
Files are never public.
Documents live in private Azure storage; access happens only through short-lived signed links generated for you, at the moment you ask.
Login without passwords.
Email OTP codes and Google/GitHub sign-in — no password database to breach. Sessions use short-lived signed tokens, rotated automatically.
Payments never touch us.
Razorpay handles cards and UPI; we verify cryptographically signed confirmations and never see card numbers.
Audited actions.
Sensitive events — logins, exports, deletions, payments, sensitive-document access — are logged for your protection.
Least drama on our side.
Rate limiting, security headers, dependency audits and secret scanning in CI, keyless cloud identities in production.
Found something? security@roleora.com — we take reports seriously and respond fast. Read our Responsible Disclosure policy for what to expect.