Security

How we protect your data

Scan2Review handles business and customer data with the same care we'd want as a customer ourselves.

Password hashing

Passwords are hashed with bcrypt (12 salt rounds) — we never store or log plain-text passwords.

Token-based authentication

Signed JWT access tokens with short expiry, plus separate longer-lived refresh tokens, so a leaked access token has a limited window of use.

Role-based access

Business, staff, and superadmin roles are enforced server-side on every API route — the mobile app and dashboard are just the UI.

Transport security

All traffic to scan2review.in and our API is served over HTTPS, with security headers (X-Frame-Options, X-Content-Type-Options, Referrer-Policy) on every response.

Secure password resets

Reset links use single-use, cryptographically random tokens that expire after one hour and are invalidated the moment they're used.

Data export and deletion

Business owners can export or permanently delete their account data on demand from the mobile app or dashboard.

Payments

Card and payment details are handled entirely by Stripe and Razorpay — Scan2Review never receives or stores full card numbers on our servers.

Reporting a security issue

If you believe you've found a security vulnerability in Scan2Review, please report it through our contact page rather than filing a public issue. We take reports seriously and will respond as quickly as we can.