Where your data lives, and what protects it
Most billing apps describe security in adjectives. This page describes it in specifics — including the parts that are not protected, because a promise you cannot check is not worth much.
Your business data stays on your device
Your customers, products, bills, credit ledger and stock live in a database file on your own phone. They are not uploaded to Vanij, and they are not synced to a company server in the background.
This is not a policy promise — it is a structural one. Our servers have no table that could hold your business data. The only things our systems store are what you would expect: your licence record, support tickets you raise, and the account details tied to a purchase.
What actually leaves your device
Being precise matters more than sounding absolute, so here is the real list.
- Your business data: never, except to destinations you own — your own Google Drive backup folder, your own device storage, or another of your own counters over your own Wi‑Fi.
- Your email address: reaches our servers when you redeem or restore a licence, when you contact support, and as part of backup and activation health signals the app sends automatically.
- Support messages: only what you type into Vanij Assistant, when you type it.
- Diagnostic logs: only if you switch on debug mode and then approve the upload — see below.
Stated plainly: we do not claim “nothing ever leaves your device”, because your email address does. What does not leave is your business data.
How your data is protected on the device
This is the section most security pages quietly skip, so here it is in the same words our in-app Privacy Policy uses:
Your business data is protected by your phone’s own operating-system-level storage protection — the same protection every other app’s data on your phone gets — plus Vanij’s optional App Lock (PIN) if you turn it on.
The limit: Vanij does not additionally encrypt this data itself. If your phone is unlocked or compromised, this data is not separately protected beyond what App Lock provides. Encrypting the database itself is planned work, not a shipped feature, and we would rather say so than imply otherwise.
Backups go to places you own
Vanij backs up to your own Google Drive, into an app-private folder, and to a backup file on your own device that you can save or share anywhere you like.
The app asks Google only for access to its own private folder — it cannot list, read or touch the rest of your Drive. The backup travels from your device to Google directly; no Vanij server sits in that path, so we have no access to your Drive backup and no way to read it.
You can optionally turn on AES‑256 passphrase encryption for those backup files, with the passphrase never leaving your device.
The limit: backup encryption is off by default. Until you turn it on, your backup file is an ordinary database file — anyone who obtains it can open it. If you keep backups on shared storage, turn it on.
App Lock and Staff Mode
App Lock puts a PIN in front of the app. The PIN itself is never stored — only a salted hash of it — and five wrong attempts trigger a five-minute lockout. Where your phone supports it, biometrics can stand in for the PIN.
Staff Mode is for handing the phone across the counter. In it, purchase prices, profit, Reports, Settings and udhaar totals are hidden; staff can bill and record payments, nothing more. The PIN guards leaving Staff Mode, not entering it, and the app returns to Staff Mode on a fresh launch so nobody is left holding an unlocked owner session.
The limit: App Lock is a practical guard against someone picking up your phone. It is not designed to withstand an attacker with unrestricted access to the device’s storage, and a short numeric PIN never is.
Your licence works offline
Your licence is a signed file, checked against a key built into the app using Ed25519 signatures. That check is pure local maths — your licence keeps working with no internet at all, indefinitely.
Separately, when the app can reach us, it makes a best-effort check that the licence has not been revoked. If that check fails or you are offline, nothing changes and you are never locked out because of it.
Counter-to-counter sync stays on your Wi-Fi
When you run more than one counter, they sync directly to each other over your own network — the data does not travel through us.
The connection runs over TLS. Pairing is gated by a PIN that rotates every 30 seconds, with a lockout after repeated wrong attempts, and each paired device holds a token that you can revoke from the host at any time. After the first pairing, the joining device remembers that exact counter’s certificate and refuses any other.
The limit: the certificate is trusted at the moment you first pair, so pair the two devices on a network you trust rather than on open public Wi‑Fi.
Payments never touch our servers
Card details are entered directly into Razorpay’s own hosted checkout. They do not pass through, and are not stored by, any Vanij system — our server only asks Razorpay to create an order for an amount it calculates itself, so a tampered page cannot change what you are charged.
The one-time password at checkout verifies your mobile number, so your GST invoice carries a number that has been confirmed. It is stored only as a hash, expires quickly, and is rate-limited.
Diagnostic logs are opt-in, twice
If support needs device logs to diagnose a problem, debug mode has to be switched on deliberately — it writes nothing at all until then. Before anything is sent, you are shown the exact bundle and have to approve it. Afterwards debug mode switches itself back off and the logs are cleared.
Logs are scrubbed as they are written, for GST numbers, phone numbers, rupee amounts and email addresses.
The limit: that scrubbing covers those specific patterns. We do not claim every possible personal detail is stripped — which is exactly why you get to read the bundle before it leaves.
If anything here is unclear, or you think something on this page is wrong, write to support@vanijbill.com. Corrections to this page are welcome — it is meant to be checkable.