Safety & privacy
Aadhaar safe. Customer data safe.
Velosta handles Aadhaar, passport and payment information every day. We take that seriously — every decision is aligned with India's new data protection law (DPDP).
10 security pillars
Privacy is built into the app
Aadhaar, passport, customer data, access control, audit log — each has a clear rule. Not just policy on paper, but enforced in the code.
Full Aadhaar is never stored
The app rejects any full Aadhaar card or number — fail-closed. Only a masked copy (last 4 digits visible), the name and address are kept, encrypted, in a private vault that only your store can access.
Government-verified KYC
Beyond a camera scan, you can verify a customer against official government records through DigiLocker — so you know the identity is genuine, not just a photo of a card.
Encrypted file storage
Bike photos and customer ID images are stored encrypted in AWS S3. Different types of data live in separate buckets, so nothing can leak across them.
Login security
Short access tokens (15 minutes) plus refresh tokens (7 days). If a token is stolen, the system detects it and logs the user out on its own.
Staff permissions
Admin, Manager and Staff each get their own permissions. Staff can only see their own branch — never another branch's data.
Activity log
Every change is recorded — who, what, time, IP and device. If something goes wrong, you can check easily.
Each store's data is separate
Your store's data is visible only to you. At the code level, every query is scoped to your store — another store's data can't be accessed even by accident.
30-day deletion grace
To delete an account or store, you have to verify with OTP. There's a 30-day grace period, after which all the data is permanently deleted.
Privacy by default
Scan requests are not stored in our logs. A customer's personal data never reaches our logs at all.
Protection from bots and attacks
Rate limiting, security headers, encrypted passwords, input validation — the basics are all in place.
FAQ