We use cookies to understand site usage and show relevant ads. See our Cookie Policy.

Security

Your residents' data deserves
a straight answer.

myKutir stores billing records, resident profiles, payment history, gate logs, and complaint data for residential housing societies across India. This page explains exactly how that data is protected, encrypted, and handled — no marketing language.

ISO 27001:2022
Certified information security management
TLS
All traffic encrypted in transit
AES-256-GCM
Sensitive credentials encrypted at rest
bcrypt ×12
Passwords hashed — never stored plaintext
DPDP 2023
India data protection law compliant
Technical controls

How your society's data is protected

These are implemented controls verified in our codebase — not aspirational claims.

Encryption — in transit and at rest

All traffic between your device and myKutir servers uses TLS. Passwords are hashed with bcrypt (cost factor 12) — your plaintext password is never stored or transmitted. Sensitive credentials (payment gateway secrets, LLM API keys, webhook signing secrets) are encrypted at rest with AES-256-GCM before being written to the database. Community chat messages are also AES-256-GCM encrypted at rest.

Authentication

myKutir supports email/password login with automatic account lockout after repeated failed attempts. Mobile apps support biometric login (Face ID / Touch ID via hardware-backed secure enclave — biometric data never leaves your device and is never transmitted). OTP verification via SMS is available for resident login. Society Admin accounts support two-factor authentication (TOTP).

Role-based access control

Every user is scoped to a role and a specific society. Residents cannot see financial records, security guards cannot access resident payment history, and committee members from one society never see another society's data. Access control is enforced at the API level on every request — not just at the UI level. There is no cross-society data leakage by design.

Infrastructure

The platform runs on dedicated servers behind private network firewalls with server-level DDoS protection. All database credentials, API keys, and signing secrets are managed via encrypted environment variables — nothing is hardcoded in source code. Automated daily backups with off-site encrypted storage are maintained. Session tokens on mobile are stored in device-level secure storage (iOS Keychain / Android Keystore), not in browser-accessible storage.

AI Assist — what is and is not sent

When you use AI Assist features (complaint drafting, notice writing, financial narrative, AGM minutes summarisation), only the text you actively type into those input fields is sent to our AI service for processing. No billing records, payment amounts, resident contact details, phone numbers, flat numbers, or authentication data are ever transmitted to any external AI service. Payment gateway credentials are stored encrypted in the database and never leave the backend.

Payments

Resident payments are processed via Razorpay, a PCI-DSS Level 1 compliant payment gateway. Card numbers, CVV, and bank credentials are entered directly on Razorpay's hosted payment page — they never pass through myKutir's servers. myKutir receives only a payment confirmation token. Your society's Razorpay API secret and webhook signing secret are AES-256-GCM encrypted before being stored in the database.

Compliance

Indian legal framework

myKutir operates under Indian law and is subject to these frameworks.

Information Technology Act 2000 (as amended 2008)
India's primary legislation governing electronic transactions, cybercrimes, and data held by intermediaries.
IT (SPDI) Rules 2011
Reasonable Security Practices and Procedures for Sensitive Personal Data — prescribes the security standards myKutir applies to resident data.
Digital Personal Data Protection Act 2023 (DPDP)
India's modern data protection law. myKutir supports resident data export, erasure requests, and consent management as required. Security incidents affecting personal data are reported as mandated.
Razorpay — PCI-DSS Level 1
Payment Card Industry Data Security Standard Level 1 certification held by Razorpay. Card data is handled entirely by Razorpay and never stored by myKutir.
ISO/IEC 27001:2022 Certified
myKutir is ISO 27001:2022 certified — the international standard for information security management systems (ISMS), covering how we identify, manage, and reduce information security risk.

Responsible Disclosure

If you discover a security vulnerability in the myKutir platform, email [email protected] with a description and reproduction steps. We do not pursue legal action against good-faith security researchers. We acknowledge all reports within 48 hours and resolve confirmed vulnerabilities within 30 days. Please allow time for remediation before public disclosure.

FAQ

Security questions answered

Common questions from committee members, Data Protection Officers, and IT administrators.

Security contact

Questions about your society's data?

For data protection enquiries, DPDP Act requests (data export, erasure, consent withdrawal), or security vulnerability reports, reach out directly.

This page reflects the security controls implemented in the myKutir platform as of the date shown in our last update. Security is an ongoing practice — if you notice something that should be updated or corrected, email [email protected].