Security

1. Bills can't be tampered with

A settled bill cannot be deleted or edited. Cancelling a bill records who did it, when and why, and every sensitive action at the counter is written to a log the owner can check.

2. Sign-in and staff PINs

• Owners sign in with a one-time code sent to their mobile; repeated wrong attempts are blocked for a while.
• Each staff member has their own PIN, stored only as a salted, slow hash (PBKDF2), so a lost tablet does not give the PINs away.
• Our own admin team uses separate accounts, and every change they make is recorded.

3. Encryption

• Every connection to ThaliKhali uses HTTPS, and browsers are told never to connect without it.
• Payment gateway keys are stored encrypted with AES-256.
• Backups are encrypted before they leave our server.

4. Backups, tested every week

Your data is backed up every night to storage kept apart from our main server. Every week we restore the latest backup into a fresh database and check it, so we know it works before we ever need it.

5. Billing without the internet

The counter keeps billing when the internet or our servers are down. Bills wait safely on the device, numbered so two counters can never clash, and upload when the connection returns.

6. Separate businesses, separate data

Every request is checked against the business and outlet it belongs to, so one restaurant can never see another's data. Each change we ship is tested end to end before it goes live.

7. Your data, your copy

You can download all your bills, menu and customers at any time.

8. Report a security problem

If you think you have found a weakness in ThaliKhali, please tell us privately: call or WhatsApp WhatsApp +91 90825 36997 · +91 90825 36997, write to us at Eleven Labs (India), 13th Floor, WeWork 247 Park, Vikhroli West, Mumbai 400079, Maharashtra, India. Tell us what you found, where, the steps to see it, and what an attacker could do with it. We reply within 2 working days and keep you updated until it is fixed.

Please do: test only with your own account or a test account, stop as soon as you see someone else's data, and give us reasonable time to fix the problem before telling anyone else.

Please do not: slow down or take down the service, send spam, trick our staff or restaurant staff, access or change data that is not yours, or try to get into offices or devices.

In scope: thalikhali.com, the ThaliKhali app and its API, and restaurant pages and e-bills served by ThaliKhali. Out of scope: payment gateways, WhatsApp and other services we use, and reports about missing best practices that do not show real harm.

We will not take legal action against anyone who reports in good faith and follows these rules.