Security at Munshiji
Your books are your business. Here is what protects them today, and what we haven’t finished. We only list what is true right now.
What we do today
Your own login
Everyone signs in with their own login, and sessions expire. Passwords are stored as hashes, not as plain text. Repeated sign-in attempts are slowed down.
Two-step sign-in
You can turn on a second step using an authenticator app, with backup codes. It is your choice for now.
Roles
Roles decide who in your business sees money, stock and customers.
Audit trail
Changes to invoices, settings and access are written to an audit trail.
Encrypted keys
Keys for connected services are stored encrypted (AES-256-GCM). Data travels over HTTPS.
Bridge only reads Tally
The Bridge app reads from Tally. It does not write to it.
AI needs your yes
Ask Munshiji is in Beta. Before text goes to an AI provider, identifiers such as PAN, phone and bank numbers are masked by default. AI output is a draft, and a person approves filings and payments.
Not done yet
Please don’t count on these until we mark them as done here.
- Hosting in India Coming
- Outside security testing Coming
- Stronger walls between companies at the database level Coming
- Logs of when staff read a customer’s data Coming
What we don’t claim
We don’t hold security certificates such as ISO 27001 or SOC 2, and no software can promise that nothing will ever go wrong.
Found a security problem?
Please tell us through the contact page, and don’t share details publicly until we have had time to fix it. Read our privacy policy for how we handle personal data.