YesBOSHome / Your data
Your data
It is your business's data. We hold it, we do not own it.
Where it lives, who can reach it, what happens if you leave, and what we do and do not do with it.
How separation actually works
Not a filter in the application code that somebody can forget to write.
Enforced in the database
Every one of the 114 tables carries a row-level security policy tied to the signed-in owner, forced on so that even the account that created the table cannot read across shops. A missing check in application code cannot leak data past it.
Least privilege
The application connects as a role with no permission to create or alter tables. Schema changes are a separate, deliberate step — so a bug in a request cannot restructure your database.
Audited
Who changed a price, cancelled a bill, gave a discount over the cap, or closed the shop. Kept, and readable by you.
Straight answers
Where is it kept?
On servers in India, with encrypted backups taken nightly and tested by restoring them — an untested backup is not a backup.
Do you sell it?
No. Not to brands, not to lenders, not to aggregators, not as an anonymised dataset. If we ever want to share anything, it will be with your explicit consent for a specific purpose, which is what DPDP requires and also what is decent.
Can I get it out?
Yes, all of it, free, in formats that open elsewhere — and in the shapes a chartered accountant and Tally expect. Leaving cheaply is the only thing that makes "free" trustworthy.
Who on your side can see it?
Support cannot browse your shop. Access for a specific problem is granted by you, time-limited, and logged.
What about my customers' numbers?
They are your customers. Consent is recorded, withdrawal is honoured, and marketing messages respect it — including when it is inconvenient.
What we have not done yet
No third-party penetration test has been published, and no ISO or SOC 2 certificate exists. Those cost real money and we would rather spend the current money on the product; when they exist we will link them here rather than describing them vaguely.
If your business needs a certificate today, this is an honest reason to wait — and we would rather tell you now than during procurement.
Read the policy, not the summary.
The privacy policy, the terms and the DPDP consent notice are all linked in the footer, written to be read.
One month, everything included. No card to start. Cancel inside the month and you are not billed.