Data & Security

01At a glance

02Infrastructure

The site is served from Cloudflare Pages, the API is a Hono application running on Cloudflare Workers, and data sits in Cloudflare D1 with files in Cloudflare R2. Requests reach the API through a same-origin proxy that deliberately strips forwarding, authorisation and geo metadata headers before the Worker sees them, so the application is not passed visitor location or raw auth context.

• All traffic is HTTPS; TLS is terminated and managed by Cloudflare
• The browser bundle ships without source maps
• Storage regions are selected by Cloudflare and are not pinned to a named country by us. If a contract requires India-only residency, ask us at [email protected] before relying on it
• Production builds are deployed from a private repository through a single CI job

03Store isolation

This is the control that matters most, because a shared pharmacy database is exactly what a patient would fear. Every read and write in the API is scoped by your store identifier. There is no query path that returns another store's invoices, buyers, stock or suppliers to you, and none that aggregates your patient records into a cross-store dataset.

• A person who buys at two Anvip pharmacies exists as two unrelated rows. We do not link them
• Access is granted by role: owner, manager, biller, viewer. A store has one owner
• Bulk exports and the customer register additionally require full workspace mode and an owner or manager role. Stock-only stores hold no customer records at all
• Team member accounts are created by the owner, who sets the initial password - a deliberate design with a real consequence, so read the note on it in Terms

04Accounts, sessions and passwords

05Two-factor authentication

Time-based one-time passwords are available to every account type, and we recommend them for owners.

• Six digits, 30-second validity, one step of clock tolerance, standard RFC 6238 - so any authenticator app works
• The setup QR code is drawn by the app itself on your device; no external QR service sees your secret
• Ten single-use recovery codes, stored hashed, each consumed once and marked used
• Turning two-factor off requires your password and a current code, so a stolen password alone is not enough to strip your protection
• It is optional today, not enforced. Enabling it is a Settings change that takes about a minute - please do it. A lost password has no self-service reset, so treat your recovery codes as the paper records you would not throw away

06Payments

Money moves through Razorpay's hosted checkout, which keeps card and UPI interaction off our servers. Our side of the design is about making a payment impossible to fake or reuse.

• The price is resolved from our own plan record on the server. A browser cannot ask for a different amount
• An order is short-lived - about 30 minutes - and unpaid orders simply lapse
• After checkout we re-fetch the order and the payment from Razorpay and require an exact match on amount, currency, receipt, store and plan before granting access
• The webhook is authenticated with an HMAC signature and runs the same re-check, so a forged callback cannot create access
• Each order can be activated once; a replayed verification is rejected
• Stored payment data is limited to identifiers, amount and dates. No card number, no expiry, no CVV - see the Privacy Policy

07Uploads and stored files

The only file a store can upload is its own logo: up to 300 KB, and the type is decided by inspecting the file's magic bytes rather than trusting what the browser claimed, so an HTML or script payload cannot be dressed up as an image. Replacing or removing a logo deletes the old object. Logo responses carry a nosniff header.

There is no upload path for prescriptions, reports or documents of any kind, which is why the Privacy Policy can say flatly that no patient images exist in our database.

08Exports and printing

• Accounting export is restricted to owner and manager roles and to a bounded date window, 366 days at most; the full set of ceilings is tabulated in Terms
• Downloaded files are served with a no-store cache directive so they do not linger in a shared browser
• Every exported cell is guarded against spreadsheet formula injection: text starting with = + - or @ is neutralised, so a medicine name or buyer name cannot execute inside Excel
• The partner dashboard shows up to 100 of your own referral records, and nothing belonging to another partner
• Invoices reach your customers as a printed bill or a PDF you save from the browser. Anvip emails nothing to anyone

09Backups and recovery

A scheduled job takes a JSON snapshot of the business tables every day - stock, batches, purchase and sales invoices, line items, buyers, suppliers, subscriptions, payments, commission ledger and store profiles - and writes them to private object storage, keeping a dated copy and a latest copy. Losing the database is therefore a recovery exercise rather than a catastrophe.

• Snapshots are not public and are not served to browsers
• Per-table failures are isolated, so one bad table cannot abort the run
• Restoration is a manual, operator-run procedure today. There is no automated failover, no point-in-time replay, and no tested disaster-recovery clock
• Snapshots age out only when we act on them. That is why an erasure request under the Privacy Policy explicitly includes clearing backup copies, not just the live row
• Your own discipline is part of the plan: take the accounting export periodically and keep it. Do not let us be the only copy of your statutory records

10Logging

Stated completely, because a security page that hides its logging is not a trustworthy one.

• The API records a request line for each call: method, path, status and duration. Because some search boxes use query strings, text typed into a search - a buyer name, for example - can appear in that log entry
• Request bodies, cookies, authorisation headers and IP addresses are not written to application logs
• The application does not capture visitor IP addresses or user-agent strings at all. Referral visits are anonymous counters
• Platform-level telemetry held by Cloudflare and Razorpay is governed by their settings and their own policies
• There is no third-party analytics, error-reporting or session-replay service in the product
• There is no separate audit trail of administrative reads yet; staff activity is limited by design rather than monitored

11Who at Anvip can see what

Administration is one allowlisted account. It can see store identity, address, contact fields, drug licence number, GSTIN, owner name and email, invoice counts, total billed value, subscription dates, payment identifiers, partner records including UPI IDs, and the free-text notes on demo and email-change requests. It can suspend a store and can grant time-limited access, each grant recorded with a written reason.

It cannot, through any route in the product, list a store's invoice line items, open the customer register, read dosage instructions, or export patient data. Aggregates are counts and totals, not records.

12What we do not promise

We would rather you learn this here than discover it later.

• No SOC 2, ISO 27001, PCI-DSS or any other third-party attestation. Card data is outsourced to Razorpay, but we make no compliance claim about Anvip itself
• No uptime guarantee, no service credits, no contractual recovery time
• No published penetration-test or vulnerability-scan report, and no bug-bounty programme
• No rate limiting, login-attempt lockout or progressive delay yet - bot checks and password-hashing cost are the current defence
• No field-level encryption of database columns beyond the platform's own storage protection, and no key-management separation from the database
• No self-service account closure, data-deletion request or full data export inside the app; those go through email and are handled by hand
• No signed data-processing agreement, custom contract, on-premise deployment or security questionnaire response
• No email or SMS verification of an address at signup, which means an account email is claimed, not proven - keep your address private and never share a login

If any of these are hard requirements for you, the honest answer today is that we do not offer them at all, and those controls belong with enterprise vendors. We will tell you the same thing before you pay as after.

13Protecting your pharmacy

Most real-world compromises of a counter system come from the counter, not the software. A short checklist:

• Turn on two-factor for the owner account the day you set up, and save the recovery codes somewhere physical
• Use a password nobody else has, and never the store's public phone number or licence number
• Give staff the lowest role that lets them work. A biller does not need manager
• Remove a departing team member immediately - deleting the membership signs their session out
• Do not share your login with a consultant, an accountant, or a software representative, and never let a partner register on your behalf
• Record a buyer name only when you need it; the default walk-in entry exists for a reason
• Lock the counter device, and do not save the workspace password in a shared browser
• Take a periodic accounting export, and keep printed or PDF bills as your own statutory copies
• Check the printed invoice against the pack before handing it over: medicine, batch, expiry, dose, schedule

14Reporting a problem, and how we handle one

If you find a weakness, or believe an account is compromised, write to [email protected]. Please report in good faith: prove a point without exfiltrating patient data, and give us a chance to fix it before telling anyone. We aim to acknowledge within 2 working days, and we will credit a reporter who wants it.

If we become aware of a breach that affects your workspace, we will contact affected account holders by email without undue delay, say what was exposed, describe what we have done, and tell you what you should do next - including where we cannot say more. We will not dress up an incident, and we will not pretend a notification happened that we did not send.

15Contact

Security questions, requests for our handling of a specific control, or a written statement of how data is processed for your records: [email protected]. See also the Privacy Policy for what we collect and how long we keep it.