Security and compliance
Your stock levels and your customer list sit in these systems. Here is how they are protected, and what we will sign before we see any of it.
Answers the same working day. Based in Lahore, working to your time zone.
What is switched on by default
None of these is an upgrade tier.
Encryption at rest
AES-256
Databases and backups are encrypted on disk, including the off-site copies.
Encryption in transit
TLS 1.3
Every connection between a till, a browser and the server is encrypted.
Access control
RBAC
Roles decide what a cashier, a manager and an owner can see. Our own access is separate and revocable.
Audit logging
Append-only
Logins, price edits, refunds and stock adjustments are written with the user and the timestamp.
Secure development
OWASP Top 10
Threat modelling before the build, code review before the merge, and no secrets in the repository.
How client data meets AI models
The model in a client system is chosen per engagement. Our write-ups show the range: OpenAI in Anatomia, Gemini on Vertex AI in Obelisk, and models reached through OpenRouter in Bonnet.ai.
In Polaris, a question asked in Urdu or English only reads. Anything that writes goes through the same permission check as a person pressing the button.
Non-disclosure agreement (NDA)
We sign before the first technical discussion. Yours or ours, whichever you prefer.
Data processing agreement (DPA)
For work touching personal data, covering us as processor and you as controller.
Send us your security questionnaire.
Email or WhatsApp it over. We fill in every row we can evidence and mark the rest as open. If your procurement team needs a call with an engineer, they get one.
Talk to us about security- First reply
- same working day
- Hours
- Set to your time zone
- Built in
- Lahore, Pakistan