Security and trust

How we protect your company's data

Thoshika holds payroll, accounts and customer records, so security is part of the platform rather than a setting. This page describes how it works today, without marketing gloss.

Tenant isolation in the database

Every company-owned table carries the company identifier and a PostgreSQL row-level security policy
The application connects as a database role that cannot bypass those policies
The company is set on each database connection from the signed-in token and cleared when the connection is returned
A query that forgets a company filter still cannot read another company's rows

Sign-in and sessions

Passkeys (WebAuthn) with Touch ID, Windows Hello and Android or iOS devices
Authenticator-app codes, and an MFA policy for administrators or everyone
Single sign-on with SAML 2.0 or OpenID Connect, and SCIM 2.0 provisioning
Access tokens last 15 minutes; refresh tokens rotate, are stored hashed, and a reused token ends the whole session
Idle and absolute session limits and an IP allowlist, set per company
On mobile, the session is held in the device keystore and released after a biometric check

Roles, scopes and app access

Each app has its own roles; a person reaches an app only if the company has switched it on and they hold one of its roles
Roles can be limited to a location, legal entity, GSTIN, branch or similar scope
Sensitive fields such as Aadhaar and bank details are masked in the change history
API keys and OAuth apps carry roles and scopes too, and can never hold administrator roles

Audit and logs

Field-level change history on business records: who changed what, and when
A sign-in log of successes, failures and blocks, with method and IP address
Every public API call logged with client, path, status and latency for 90 days
Effective-dated records keep history instead of overwriting it

Encryption and secrets

Traffic between browsers, apps and Thoshika uses HTTPS
Integration credentials and calendar tokens are encrypted with AES-256-GCM, with a key derived per company
Document-signing private keys are encrypted at rest
Sangam calls and meetings of up to 25 people can be end-to-end encrypted

Privacy and the DPDP Act

Hosted in India · data stays in India. Data processing follows DPDP Act 2023 obligations.
Data principal requests in People, routed to your data protection officer
Consent and purpose recorded for leads and contacts in CRM
Erasure and retention settings in Sangam; privacy notices on public forms and booking pages

Certifications

Where we stand

Thoshika does not hold security certifications today. Independent audits are planned, and we will publish the results here when they are complete.

Enterprise customers can request a data processing agreement and a security review as part of their contract. See our privacy notice for how we handle personal data.

Report a security issue

If you believe you have found a vulnerability, please write to us with the details and steps to reproduce. Please do not access other customers' data or disrupt the service while testing.

Security reports[email protected]

Need a security review?

We can walk your IT and security team through the architecture and answer your questionnaire.

Talk to us Single sign-on