How does Braj protect my data?

Data is encrypted in transit (TLS) and at rest, with location, address and payment metadata encrypted per user. Each town is isolated in its own encrypted config, contact details are masked end-to-end, and access is least-privilege with a full audit log.

How do I report a security vulnerability?

Email braj@ekarche.com with details and steps to reproduce. Our machine-readable policy is published at https://braj.ekarche.com/.well-known/security.txt. Please give us reasonable time to remediate before any public disclosure.

Does an operator or Braj read my data?

No. User data is encrypted per user and a town operator cannot read or resell it. There is no ad model and data is never sold.

Securityसुरक्षा

Security that holds because of how it is built

The same privacy-by-architecture stance, stated as a security posture — encryption, isolation, masked PII, an idempotent ledger, and a responsible-disclosure channel.

Privacy by architecture security.txt

Security posture

What protects your data

Encrypted in transit & at rest

Traffic is served over TLS; sensitive data is encrypted at rest. Location history, addresses and payment metadata are additionally encrypted per user.

Per-town isolation

Each town runs its own encrypted configuration — integrations, model providers and retention windows. A town operator cannot read or resell another town's, or any user's, data.

Masked PII end-to-end

Customer and partner contact is relayed through a mask — a driver never sees your real number, and you never see theirs.

Idempotent money flows

The wallet is a row-locked, idempotent ledger: no double-charge on a retry, no silent order loss, every failure path reversible, COD reconciled explicitly.

Least privilege & audit

Operator access is role-based and scoped per town, with a full audit log of config changes, verification decisions, payouts and reassignments. KYC-verify and payouts are operator-gated.

DPDP-aligned by design

Data handling is built to the DPDP framework — scoped credential storage, least-privilege, data export and delete on request, and a full audit trail.

Responsible disclosure

Found something? Tell us.

Report vulnerabilities to braj@ekarche.com. Our machine-readable policy lives at /.well-known/security.txt. Please give us reasonable time to remediate before public disclosure.

Answers

Security, in plain answers

How does Braj protect my data?: Data is encrypted in transit (TLS) and at rest, with location, address and payment metadata encrypted per user. Each town is isolated in its own encrypted config, contact details are masked end-to-end, and access is least-privilege with a full audit log.
How do I report a security vulnerability?: Email braj@ekarche.com with details and steps to reproduce. Our machine-readable policy is published at https://braj.ekarche.com/.well-known/security.txt. Please give us reasonable time to remediate before any public disclosure.
Does an operator or Braj read my data?: No. User data is encrypted per user and a town operator cannot read or resell it. There is no ad model and data is never sold.