How we protect your record
Plain answers about what protects your work.
Encryption.
TLS in transit; encryption at rest on Azure. Journal encryption adds a client-side layer we cannot open.
Your data is fenced.
Every database query is scoped to your account. Tenant isolation is enforced in one shared code path and tested on every feature. Requests for someone else's data return “not found,” revealing nothing.
Files are never public.
Documents live in private Azure storage; access happens only through short-lived signed links generated for you, at the moment you ask.
Sign-in you can lock down.
Sign in with an emailed code, a password, or Google or GitHub. Add optional two-factor sign-in. Passwords are stored only as salted hashes. Sessions use short-lived signed tokens, rotated automatically.
Payments never touch us.
When payments open, Razorpay will handle them. We check its signed confirmations and never see card numbers.
Audited actions.
Sensitive events are logged for your protection: exports, account deletion, two-factor changes, signing other sessions out, and opening a sensitive document.
Least drama on our side.
Rate limiting, security headers, dependency audits and secret scanning in CI. Azure AI, Speech, Vision, Storage and Key Vault use managed identities, with no keys in code.
Found something? Write to security@roleora.com, and read our Responsible Disclosure policy for what to expect.