This page says what Vyom Desk does to protect a shop's data, what leaves the shop, and what we have not done yet. It is written to be checked, not to impress.
Your data stays in your shop
Vyom Desk keeps the shop's books in a PostgreSQL database on the shop's own computer. We do not host it and we cannot see it. The counter keeps working when the internet does not, because it never depended on it.
What leaves the shop
- A check for new versions, which tells us only the version in use.
- When the owner registers the shop at setup: the name, address, GSTIN and contact details on the letterhead, the version and the activation code. Never sales, stock, customers, staff or accounts.
- Nothing else. There is no hidden analytics and no remote access to the shop's data.
Who can do what
- Each person signs in with their own account. Passwords are stored as BCrypt hashes (cost 12), so they cannot be read back, even by us.
- Access is by role, with many separately assignable permissions. A cashier gets what a cashier needs, and a manager's PIN is required for the things you choose to reserve, such as a discount beyond a limit.
- People can be limited to particular branches.
Backups
Vyom Desk takes a backup when the day is closed, and a safety-net backup if the shop goes a day without closing. Every backup is read back before it is called good. Backups are written to a folder you choose; keeping a copy off the computer, on a drive or cloud folder you control, is your protection against losing the machine.
Updates
New versions are announced by a manifest signed with our release key; the counter checks the signature and the installer's checksum before it offers an update, and nothing is installed unless a person at the shop chooses to. Licence keys are signed offline with a key that is never on a server.
Our side
The console we use to manage customers, invoices and licences is separate from the website, is reachable only on its own address, and requires two-factor sign-in for administrators and accounts staff. Staff actions are recorded in an audit trail. Card details never reach us.
What we have not done yet
We would rather tell you than leave you to find out.
- We do not hold ISO 27001, SOC 2 or similar certifications.
- We have not yet had an independent penetration test.
- E-invoicing (IRP) and e-way bill generation are not included yet.
- There is no built-in off-site backup service yet.
Reporting a problem
If you find a security problem, write to support@keenminds.in. We will reply within +91-9538216454 working days and will not take action against anyone who reports in good faith.