Security & Compliance

• Google Sign-In only: GetQi does not store passwords. Authentication is delegated to Google's identity infrastructure. We verify the Google ID token server-side before issuing any session.
• JWT (HS256): After sign-in, we issue a short-lived access token (JWT) and a long-lived refresh token. The refresh token is stored as a browser cookie (SameSite=Lax).
• Role resolved from database: On every API request, the user's role is fetched from the database — not from the JWT claim. This means role changes take effect immediately without requiring a new token.
• No privilege escalation: Elevated roles (HR Admin, Facility Owner, Super Admin, Trainer) can only be assigned by a Super Admin via a separate authenticated endpoint.

IDOR (Insecure Direct Object Reference) protections are applied at the service layer — e.g., a Facility Owner can only scan check-ins for facilities they own. This is enforced server-side on every relevant endpoint.

• Payment processing is handled entirely by Razorpay, a PCI DSS-compliant payment gateway. GetQi never receives, stores, or processes card numbers, CVVs, or UPI credentials.
• The payment flow uses Razorpay's Checkout.js overlay — users enter payment details directly into Razorpay's interface, not into GetQi's UI.
• After payment, Razorpay sends a webhook to GetQi. We validate the webhook signature using HMAC-SHA256 and a shared secret before crediting any wallet.
• We also maintain a fallback status-check mechanism to reconcile payments in case the webhook is delayed.
• Payment disputes are logged and handled via Razorpay's dispute management system.

• Each company's data is logically isolated. HR Admins can only see data for their own company's employees.
• Wallet balances, utilisation reports, and employee listings are scoped to the HR Admin's company at the query level.
• GetQi Super Admins have cross-company visibility for operational purposes — this is auditable.
• Employee check-in data shared with facility partners is limited to: name, check-in confirmation status. Wallet amounts and employer identity are not shared with facilities.

• All HTTP responses include security headers: Strict-Transport-Security, X-Frame-Options: DENY, Content-Security-Policy, X-Content-Type-Options: nosniff.
• CORS is strictly configured in production — only authorised frontend origins are accepted.
• Swagger UI and Spring Boot Actuator endpoints are disabled in production.
• JWT signing secret length is validated at application startup. The application will not start with a weak secret.
• Scheduled background jobs (wallet resets, reconciliation, no-show processing) use ShedLock distributed locking to prevent double-execution in multi-instance deployments.

• Transaction and check-in records are retained for 7 years to comply with Indian accounting and GST requirements.
• OTP codes for company verification expire after 10 minutes and are locked after 3 failed attempts.
• User accounts can be deactivated by a Super Admin. Deactivated accounts are not deleted immediately — data is retained for compliance purposes.
• Reviews are soft-deleted (removed from public view but retained in database for audit).

We do not use third-party analytics, advertising, or data enrichment vendors.

If you discover a security vulnerability in GetQi, please disclose it responsibly by emailing us at [email protected] with the subject line "Security Disclosure". We will acknowledge your report within 48 hours and aim to resolve confirmed issues within 30 days. We do not currently offer a formal bug bounty, but we appreciate responsible researchers and will credit you if you wish.

Please do not publicly disclose vulnerabilities until we have had a reasonable opportunity to address them.

• GetQi operates exclusively in India and is governed by Indian law.
• We comply with applicable provisions of the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.
• Payment operations comply with RBI guidelines for digital payments as applicable to platform aggregators using a licensed payment gateway (Razorpay).
• GST-applicable invoicing is handled by GetQi Pvt. Ltd.

If your organisation requires a security questionnaire, vendor assessment form, or Data Processing Agreement (DPA) as part of procurement, please email [email protected]. We will respond to reasonable requests within 5 business days.