Security
How Naaradh protects merchant and customer data.
Last updated 2026-09-12
Architecture
- Every tenant’s data isolated by PostgreSQL row-level security; services that serve merchants cannot bypass it.
- Phone numbers stored as keyed hashes and encrypted ciphertext; the dashboard shows masked numbers only.
- Recordings in Google Cloud Storage (Mumbai) with customer-managed encryption keys; playback through 15-minute signed links, each access recorded in the merchant’s access log.
- Shopify access tokens encrypted at rest; webhooks verified by HMAC before any processing.
- Dashboard sign-in by single-use email links; sessions expire after inactivity; every sign-in audited.
Reporting a vulnerability
Write to security@naaradh.com. Please do not test against merchants’ live stores or real phone numbers.