A security page that lists only strengths is marketing. This one describes what is built, and then what is not built yet, because you are trusting us with client filing data and you should be able to judge that for yourself.
Accounts and access
- Passwords are hashed. Nobody at Visbig can read yours, and we will never ask you for it.
- Email sign-up requires a verification code, valid for ten minutes and stored hashed.
- Google sign-in is available, so your firm can keep its existing account controls.
- Sign-in, sign-up and password-reset attempts are rate limited per account and per address, to blunt credential stuffing.
- Every active session is listed under Settings, then Security, with its device and IP. You can revoke any one of them, or sign out everywhere else in a single action.
- Changing your password signs out your other sessions.
- One person, one account: identity verification prevents a single identity holding several.
Data
- The application, the database and the session store run on infrastructure we operate ourselves in Vienna, Austria. Where each provider processes data is listed on the Subprocessors page.
- All traffic is HTTPS, with HSTS enforced.
- Uploaded documents live in Cloudflare R2, encrypted at rest by the storage layer, keyed per user and per entity so one account's path cannot address another's.
- Every database query is scoped to the account that owns the row. Ownership is checked on the server, not assumed from what the browser sends.
- Aadhaar numbers are never stored. Verification keeps the outcome and a keyed hash, which cannot be reversed into the number.
- Government portal tokens are encrypted with a dedicated key and expire within hours.
- Voice audio is buffered in memory for the length of a turn and discarded. It is never written to disk.
- Client upload links are single-purpose, token-hashed and expire.
Accountability
- Every compliance action writes an audit entry with the actor, the resource, the before and after state, the IP and the timestamp.
- The audit trail is append-only by construction. There is no code path that edits or deletes an entry, including when an account is closed.
- Extracted document fields carry a confidence score, and corrections are recorded field by field with who made them.
- Tax invoices are immutable and numbered without gaps within a financial year.
The service itself
- The API is rate limited and connection capped, with tighter limits on authentication routes.
- Requests carry security headers: HSTS, content-type sniffing off, a constrained referrer policy.
- Application code is type-checked and linted on every change, and the API surface is tested.
- No analytics, advertising or session-recording script runs anywhere in Visbig. See the Cookie Policy.
What we have not done yet
We would rather you learned this here than found it out later.
- No independent audit. Visbig holds no SOC 2 report and no ISO 27001 certification. Neither has been attempted.
- No two-factor authentication beyond Google sign-in. Password accounts have a single factor today. This is the security gap we consider most worth closing.
- Tax identifiers are not encrypted field by field. PAN, GSTIN and TAN are stored as ordinary columns, protected by database and disk-level controls rather than application-level encryption. Some vendors describe this as "encrypted at rest"; we would rather be precise.
- No formal penetration test has been commissioned.
- Retention is not yet automated. The periods in our Privacy Policy are honoured on request rather than by a scheduled purge job.
Reporting a vulnerability
Email [email protected] with enough detail to reproduce it. We will acknowledge within 3 working days and keep you updated until it is closed. Please give us a reasonable window before disclosing publicly, and do not access, alter or retain anyone else's data while testing. We will not pursue legal action against anyone reporting in good faith within those bounds.
If something happens
If a breach affects your data, we will tell you and the relevant authority as required, with what we know, what we are doing, and what you should do. We will not wait for certainty before telling you something is wrong.