Security & data protection

Your workspace is isolated

Every record belongs to exactly one workspace. Every request is checked on the server against the workspace you are signed in to, so one customer can never see another customer's data — even by guessing an address in the browser.

Signing in

• Passwords are stored only as strong one-way hashes (never in readable form).
• Two-factor authentication with any authenticator app. Workspace owners can require it for the whole team.
• Repeated failed sign-ins are slowed down and recorded.
• You can sign out of all devices at once from your account page.

Who can see what

• Roles and permissions decide what each team member can see and do, including prices, exports and approvals.
• An activity log records important changes in your workspace.
• Coopernut staff can see account and billing information needed for support. They cannot open your business records unless a time-limited access grant is recorded — and you can see it in your activity log.

Files and links

• Uploaded files are stored outside the public web folder, checked for type, and only served after a permission check.
• Shared links for quotations, invoices, approvals and forms use long random tokens and can be revoked.

Payments

Coopernut does not store card numbers or UPI PINs. Plan payments are made by UPI directly to our account and are activated only after our finance team confirms receipt.

Backups and your data

• The database is backed up daily.
• Workspace owners can export all their data as CSV files at any time.
• If a paid plan ends, the workspace moves to the Free plan's limits — your records are not deleted. Owners can close a workspace from Settings, and our privacy policy explains how long closed accounts are kept.

Reporting a security issue

If you believe you have found a security problem, please contact us with details. Please do not access other customers' data or disrupt the service while investigating.