We use cookies to understand site usage and show relevant ads. See our Cookie Policy.
myKutir stores billing records, resident profiles, payment history, gate logs, and complaint data for residential housing societies across India. This page explains exactly how that data is protected, encrypted, and handled — no marketing language.
These are implemented controls verified in our codebase — not aspirational claims.
All traffic between your device and myKutir servers uses TLS. Passwords are hashed with bcrypt (cost factor 12) — your plaintext password is never stored or transmitted. Sensitive credentials (payment gateway secrets, LLM API keys, webhook signing secrets) are encrypted at rest with AES-256-GCM before being written to the database. Community chat messages are also AES-256-GCM encrypted at rest.
myKutir supports email/password login with automatic account lockout after repeated failed attempts. Mobile apps support biometric login (Face ID / Touch ID via hardware-backed secure enclave — biometric data never leaves your device and is never transmitted). OTP verification via SMS is available for resident login. Society Admin accounts support two-factor authentication (TOTP).
Every user is scoped to a role and a specific society. Residents cannot see financial records, security guards cannot access resident payment history, and committee members from one society never see another society's data. Access control is enforced at the API level on every request — not just at the UI level. There is no cross-society data leakage by design.
The platform runs on dedicated servers behind private network firewalls with server-level DDoS protection. All database credentials, API keys, and signing secrets are managed via encrypted environment variables — nothing is hardcoded in source code. Automated daily backups with off-site encrypted storage are maintained. Session tokens on mobile are stored in device-level secure storage (iOS Keychain / Android Keystore), not in browser-accessible storage.
When you use AI Assist features (complaint drafting, notice writing, financial narrative, AGM minutes summarisation), only the text you actively type into those input fields is sent to our AI service for processing. No billing records, payment amounts, resident contact details, phone numbers, flat numbers, or authentication data are ever transmitted to any external AI service. Payment gateway credentials are stored encrypted in the database and never leave the backend.
Resident payments are processed via Razorpay, a PCI-DSS Level 1 compliant payment gateway. Card numbers, CVV, and bank credentials are entered directly on Razorpay's hosted payment page — they never pass through myKutir's servers. myKutir receives only a payment confirmation token. Your society's Razorpay API secret and webhook signing secret are AES-256-GCM encrypted before being stored in the database.
myKutir operates under Indian law and is subject to these frameworks.
If you discover a security vulnerability in the myKutir platform, email [email protected] with a description and reproduction steps. We do not pursue legal action against good-faith security researchers. We acknowledge all reports within 48 hours and resolve confirmed vulnerabilities within 30 days. Please allow time for remediation before public disclosure.
Common questions from committee members, Data Protection Officers, and IT administrators.
Security contact
For data protection enquiries, DPDP Act requests (data export, erasure, consent withdrawal), or security vulnerability reports, reach out directly.
This page reflects the security controls implemented in the myKutir platform as of the date shown in our last update. Security is an ongoing practice — if you notice something that should be updated or corrected, email [email protected].