Data security & integrity

Everything your company records in SiteCash belongs to your company. We use it only to provide SiteCash to you. We never sell it, never use it for advertising and never show it to another company. See Terms, section 7.

• Every record (entry, voucher, bill photo, vendor bill, cash request, user and setting) is tied to exactly one company.
• On every page, download and app request, SiteCash checks who is logged in and which company they belong to, reading it fresh from the database, and only then reads or changes that company’s records.
• Bill photos and PDFs are stored in a separate folder for each company and site, and are only sent after the same check.
• Removing a person, or changing their role or sites, takes effect on their very next click, on the web and in the app.

• Owner and Admin: everything, including users, settings and the plan.
• Accountant: all sites, approvals, vendor bills, reports and Tally export.
• Site user: only the sites given to them. They cannot see other sites, vendor bill documents or company settings.

• Each site’s vouchers are numbered in order for each financial year, so a missing voucher would show as a gap.
• Vouchers are never deleted. A wrong voucher is cancelled with a reason; it keeps its number and stays visible, marked cancelled, with no effect on the balance.
• Entries made by site users wait for approval. Only approved entries are exported to Tally.
• Site users can change only their own entries, only until they are approved, and only within the number of days your company chooses (7 by default). After that only your office (owner, admin or accountant) can correct an entry, and the correction is kept in the history.
• Entries sent to Tally are locked for everyone, so SiteCash and Tally always match.
• A history is kept of who created, changed, approved, sent back, cancelled or exported each record, and when. For changes it keeps the old and the new value.
• Amounts are stored as exact rupees and paise, never as rounded decimal numbers.
• An entry saved on a phone without signal is uploaded exactly once, even if the connection drops while it uploads.
• Your company can require a bill photo above an amount you set.

• Passwords are stored only as a one-way hash (bcrypt); nobody at SiteCash can read them.
• After 5 wrong passwords for an email address in 15 minutes, further attempts are blocked for a while.
• Changing or resetting a password logs that person out on every other browser and phone.
• Phone app logins are stored only as a hash and end when the person logs out, changes their password or is removed.

• All traffic between browsers or phones and SiteCash is encrypted (HTTPS).
• The database and the bill photos are encrypted at rest by our hosting providers.
• The application and the database run in the European Union (the database in Frankfurt, Germany). Bill photos are stored in Cloudflare R2. The full list of providers is in the Data Processing Agreement.
• The database is backed up continuously and can be restored to an earlier point in time. Bill photo storage keeps several copies of every file.

Our staff open a company’s records only when the company asks for help and allows it, to investigate or fix a security or technical problem, or when the law requires it. Only named staff who need this access have it, and they are bound to keep it confidential.

If a security incident affects your company’s data, we tell your owner without delay, and within 48 hours at the latest, with what happened, what data was affected and what we are doing about it. We report incidents to CERT-In and to the Data Protection Board of India as Indian law requires. Details are in the Data Processing Agreement.

You can download your cash books, reports and vendor statements to Excel and your vouchers to Tally at any time. On request we give your owner a complete export with bill photos. After you leave we delete your data as described in Terms, section 12.

For security questionnaires or questions from your auditors, or to report a security problem, write to support@feedautomate.com.