Security & Responsible Disclosure
Perovo holds household financial data, so we would rather describe our actual security posture — including its limits — than claim a certification we do not hold.
Report a vulnerability
Email support@perovo.in with the subject line SECURITY. Include steps to reproduce and what you were able to access. We acknowledge within 3 working days and aim to ship a fix or mitigation within 30 days for anything that exposes user data.
Please test only against your own account, use the smallest amount of data needed to demonstrate the issue, do not run automated scans that degrade the service for others, and give us a reasonable window before publishing. We will not pursue legal action against researchers who follow this. We do not currently run a paid bounty programme, and we will credit you if you would like that.
What we do
- Local-first by default. Financial data stays on your device unless you switch on cloud backup.
- Per-row database isolation. Every cloud table enforces row-level security keyed to your user id, so one account cannot read another's rows. Anonymous access to administrative functions is revoked.
- Encrypted transport and storage. All traffic is HTTPS with HSTS; the database and release storage encrypt data at rest.
- Mandatory MFA for administrators. The single internal admin account cannot reach the admin surface without completing a second factor.
- Redacted crash reports. Emails, phone numbers, PAN, long identifiers and tokens are stripped from error reports before they are stored or transmitted, and you can turn reporting off entirely.
- Payments stay with Razorpay. We never receive card, UPI or bank credentials.
- Signed, verified releases. Update files are checksummed (SHA-256) and the app verifies an update artifact exists and matches before offering it.
- Automated security gates in CI. Row-level-security, migration drift, dependency and release checks run on every change.
What we do not claim
- We are not ISO 27001, SOC 2 or PCI-DSS certified, and we do not claim to be "bank-grade" or "military-grade".
- Cloud backup snapshots are encrypted in transit and at rest by the database provider, but they are not end-to-end encrypted — a snapshot is readable to your authenticated session and to our operators where support or emergency-access features require it. If that is not acceptable to you, leave cloud backup off.
- The document integrity hash is a tamper check, not a digital signature under the IT Act.
- The Android build on this site is a sideload debug build in closed beta, not a Play Store signed release.
What you can do
- Use a device lock and keep the OS updated — local-first means device security is your first line of defence.
- Export a backup regularly from Profile → Backup & data.
- Review signed-in devices under Profile → Account → Security and sign out anything unfamiliar.
- Enable cloud backup only on devices you trust.