Security & privacy

EcomPaisa is a hosted service. Your data is stored on our servers, in a database shared by all sellers, with every record tied to your account.

How your data is kept separate

Every table that holds seller data carries the owning account, and every query is limited to the signed-in account on the server.
Which account a request belongs to is decided only from your signed-in session — never from anything the browser sends.
A safeguard in the application’s database layer rejects any query on seller data that isn’t limited to one account, instead of running it.

An account can’t be used until its email address is verified.
Passwords are stored only as salted bcrypt hashes. Sessions and emailed links are random tokens, stored only as hashes.
Password-reset links work once and expire after an hour; resetting signs out every other device.
Repeated wrong passwords are blocked for 15 minutes, per email and per network address.

We don’t sell or share seller data with third parties.
Your data leaves the platform only in exports you start yourself.
Authorised EcomPaisa staff can view your account’s data to support you and run the service. They sign in separately from sellers, and every view and action is recorded in an audit log.
You can download all your data, or delete your account, yourself, any time — from Your account & data. A deleted account’s data is erased for good after 30 days.

Details are in the Privacy Policy.