Security at RetailerOS

RetailerOS holds the day-to-day data of Indian retail businesses: invoices, customer records, IMEI numbers and ledger balances. This page explains, plainly, how we protect it. We only list what we actually do today.

At a glance

Encryption in transit

Every connection between your browser or phone and RetailerOS is encrypted with HTTPS (TLS 1.2 or newer). Plain, unencrypted HTTP requests are redirected to HTTPS, and browsers are told to use HTTPS only.

Where your data is stored

Customer data is hosted in India on servers provided by Hostinger.

Access controls

For your team — each staff member gets their own login, and access is set per role and per store: someone tied to one store sees only that store, while the owner and head office see every store. The account owner can remove a staff member's access at any time.

For our team — only a small number of Khosha Systems staff can access production systems. We do not look at your business data except to help you when you ask us to, or where the law requires it.

Logging in

• Everyone signs in with your store code and their own personal PIN.
• Owners can also sign in with a one-time password (OTP) sent on WhatsApp. If one mobile number owns several businesses, you choose which one to open after the OTP.
• One device per person: signing in on a new device signs the old one out.
• Give each staff member their own login rather than sharing one.

Backups

We take regular backups of customer data so it can be restored after a fault or mistake. You can also export your own records from RetailerOS at any time.

If something goes wrong

If a security incident affects your account, we will tell you without undue delay: what happened, what data was involved, and what we are doing about it. Where the Digital Personal Data Protection Act, 2023 requires it, we will also inform the Data Protection Board of India.

Reporting a vulnerability

We welcome reports from security researchers. If you find a vulnerability:

We will acknowledge your report, keep you informed, and credit you (with your permission) once it is fixed. Our contact details are also published at /.well-known/security.txt.

Laws we build for

• Digital Personal Data Protection Act, 2023 (India)
• GST record-keeping — your invoices stay available to you for as long as your account is active, and you can export them
• WhatsApp Business Policy for messaging features
• Card payments — we do not store full card numbers; the payment provider handles them

We do not currently hold security certifications such as SOC 2 or ISO 27001.

What you can do

• Keep your PIN and registered mobile number secure; never share your PIN or an OTP with anyone, including anyone claiming to be from RetailerOS.
• Give each staff member their own login with the right role, and remove access when someone leaves.
• Tell us straight away if you think your account has been misused.

Contact