Security & Responsible Disclosure
Perovo holds household financial data, so we would rather describe our actual security posture, including its limits, than claim a certification we do not hold. Positioning in one line: privacy-first, security-conscious, local-first by default.
Report a vulnerability
Email support@perovo.in with the subject line SECURITY. Include steps to reproduce and what you were able to access. We acknowledge within 3 working days and aim to ship a fix or mitigation within 30 days for anything that exposes user data.
Please test only against your own account, use the smallest amount of data needed to demonstrate the issue, do not run automated scans that degrade the service for others, and give us a reasonable window before publishing. We will not pursue legal action against researchers who follow this. We do not currently run a paid bounty programme, and we will credit you if you would like that.
What we do
- Local-first by default. Your financial ledger stays on your device unless you enable cloud backup or use a connected feature that must send specific information to provide that feature.
- Per-row database isolation. Every cloud table enforces row-level security keyed to your user id, so one account cannot read another's rows. Anonymous access to administrative functions is revoked.
- Encrypted transport and storage. All traffic is HTTPS with HSTS; the database and release storage encrypt data at rest.
- Mandatory MFA for administrators. The single internal admin account cannot reach the admin surface without completing a second factor.
- Device app lock and account 2FA. PIN / biometric lock stays on-device; authenticator 2FA protects signed-in accounts as a separate layer.
- Read-only investment connections. Supported providers (Groww, Upstox where configured) are used to retrieve holdings and related market snapshots. They are not used to place trades, withdraw funds, or move securities. Groww connections use the provider’s API credential flow with credentials stored encrypted server-side for your account; Upstox uses OAuth where configured.
- Redacted crash reports. Emails, phone numbers, PAN, long identifiers and tokens are stripped from error reports before they are stored or transmitted, and you can turn reporting off entirely.
- Payments stay with Razorpay. We never receive card, UPI PIN or bank credentials for Pro or eSign credit charges.
- Signed, verified releases. Update files are checksummed (SHA-256) and the app verifies an update artifact exists and matches before offering it.
- Automated security gates in CI. Row-level-security, migration drift, dependency and release checks run on every change.
- No financial-data advertising. We do not sell your financial data or serve ads from it.
What we do not claim
- We are not ISO 27001, SOC 2 or PCI-DSS certified, and we do not claim to be "bank-grade" or "military-grade".
- Cloud backup snapshots are encrypted in transit and at rest by the database provider, but they are not end-to-end encrypted: a snapshot is readable to your authenticated session and to our operators where support or emergency-access features require it. If that is not acceptable to you, leave cloud backup off.
- Connected features (investments, property intelligence, AI, eSign, payments) necessarily involve third-party processing for that feature. We do not claim that nothing ever leaves the device.
- The document integrity hash is a tamper check, not a digital signature under the IT Act.
- The Android build on this site is a sideload debug build in closed beta, not a Play Store signed release.
What you can do
- Use a device lock and keep the OS updated. Local-first means device security is your first line of defence.
- Export a backup regularly from Profile → Backup & data.
- Review signed-in devices under Profile → Account → Security and sign out anything unfamiliar.
- Enable cloud backup and investment connections only on devices you trust.
- Disconnect investment providers when you no longer need sync.