Security: where your data lives

• Records (invoices, books, guests, staff, receipts) are in a PostgreSQL database that the INDRA app connects to.
• Pictures you upload for your website are files on the app server’s disk, in a folder per business, not in a third-party storage service.
• Your Matrix chat, if you use it, stays on the Matrix server you pointed INDRA at.
• AI requests, on the plan with AI, go to Anthropic’s Claude service. Without AI, none do.

The INDRA software does not make backups of itself. Backups are something the people who run the server must do, and we are not going to say that they happen until we can show how.

Every business table in the database carries the business it belongs to, and the app’s queries are written to filter by it. One deliberate exception exists: the public homestay hub reads the listings that owners have chosen to publish, and only the columns that are public. The app is built so that a business does not see another business’s records.

• Each person has a role (owner, admin, manager, accountant, staff and so on). The role decides what they can open and do, and the check happens on the server, not only in the screen.
• Payroll and books need an owner, admin, manager or accountant role. Staff see their own check-in and leave.
• Every action writes a signed receipt with the person’s name, so you can see who did what.

INDRA has no support screen, no “view as customer” login and no admin page that lists businesses. We cannot sign in as you from inside the product. Anyone who has direct access to the database or the server can read what is stored there, in the same way as anyone who runs any database. How many people that is, how that access is controlled, and whether it is logged, is not something the software can show.

• Passwords are at least 10 characters and are stored only as a salted scrypt hash.
• You stay signed in with a signed cookie that scripts on the page cannot read, that is sent only to this site, and that expires after 14 days.
• Sign-in is limited to 10 tries per email and 30 per network address in 15 minutes. Sign-up is limited to 5 per hour per address. These counters live in memory and reset when the app restarts.
• Secrets such as a Matrix access token are stored encrypted (AES-256-GCM).

There is no two-step sign-in yet.

Each receipt is hashed, linked to the one before it, and signed with an Ed25519 key. Change one old receipt and the check fails at exactly that one. You can try breaking a chain yourself, and export a verification bundle for your auditor. Receipts protect the record from changes; they do not hide it, and they are not a backup.

Tell us on the contact page. Please do not include real customer data in the message.