1. Infrastructure & Encryption
OrderBhejo runs on Supabase, a managed cloud platform, in Mumbai, India (ap-south-1). All traffic between your device and our servers is encrypted in transit using TLS, and data is encrypted at rest by Supabase.
End-to-end encryption is being rolled out account by account. In a chat that is end-to-end encrypted — shown by the lock line at the top of the chat — messages, photos, videos, voice notes and documents are encrypted on the sender's phone with XChaCha20-Poly1305, under keys exchanged with X25519 and signed with Ed25519, and only the devices of the people in that chat can decrypt them. Our servers store only ciphertext and cannot read it. Each chat's key is replaced at least weekly and whenever a device joins or leaves. You can compare a 60-digit security code with a contact to confirm nobody is in between.
Not end-to-end encrypted, by design: support chats (our team must read them to help you), public channels and communities, and chats on accounts where encryption is not yet active. These are encrypted in transit and at rest, and our servers can read them to deliver and sync them. Staff access is restricted at the database level to the official channel and to support chats a user has opened. Push notifications carry only the sender and the kind of message, never its content. Messages saved on your phone for offline use are encrypted with a key kept in your phone's secure keystore. An optional recovery key lets you restore encrypted chats on a new phone; it is generated on your phone, we never see it, and we cannot reset it.
Our infrastructure provider, Supabase, maintains SOC 2 Type II and ISO 27001 certification for the platform it operates, and hosts on AWS data centres. Those certifications belong to Supabase and cover the infrastructure OrderBhejo runs on — they are not certifications of OrderBhejo itself, and we do not claim them as ours.
2. Database Row Level Security (RLS)
We enforce Row Level Security on every database table, so the database itself — not just the app — decides which rows a request may read or write. Each request carries a signed token identifying the account, and policies are written so one account cannot read or alter another's messages, products or orders.
3. Multi-Device Authentication & Session Revocation
Pairing OrderBhejo Web requires you to scan a QR code with your phone, and the pairing code it carries is single-use and short-lived. Your phone stays in control: the Linked Devices screen lists every session with its device name, platform and when it was last active, and you can revoke any of them, which ends that session. We do not show IP addresses.
4. Backups
Backups of the database are taken and retained by Supabase as part of the managed platform we run on. Separately, and under your own control, you can export a copy of your chat history to your own Google Drive from the app at any time — that copy is yours, and it sits in your Google account rather than ours.