Security and data handling, product by product

About 40 rights in 7 groups

Roles for tenant admin, counter operator, accountant, report viewer, gate scanner and kiosk device. Each person’s navigation is built from their rights, not just a role name.

Counter-scoped data

A counter operator sees only their own counter’s collections.

Immutable receipts

No duplicate numbers. Corrections and reprints are controlled and logged, and each receipt has a QR code with a public verification page.

Encrypted PAN and Aadhaar

Both are optional devotee fields and are stored encrypted.

Audited support access

Our support team can enter a temple’s account only with a stated reason, and every entry is logged.

Devotee OTP login

Devotees sign in to the temple website with a one-time password; online and kiosk receipts follow the same numbering and immutability rules as the counter.

Paired kiosk devices

A kiosk works from a paired kiosk URL under its own kiosk-device role.

Multi-tenant by design

Each temple signs in on its own path, and a trust can share one devotee master across its own organisations.

Encrypted, masked ID numbers

Aadhaar, PAN, driving licence and voter ID numbers are format-checked, stored encrypted and shown masked. Kshetra records ID documents; it does not verify them with any government database.

66 permissions

Roles for super admin, temple admin, booking clerk, accounts and viewer, built from 66 permissions.

Audit logs

An audit-log report sits alongside occupancy, collections and cancellation reports.

No double bookings

Bookings are processed one at a time per temple with idempotent requests, and unpaid holds expire automatically.

Team roles with permissions

Admin, operator and viewer roles for the temple team, with six “can manage” switches.

Recordings with limits

Recordings go to cloud storage with limits and automatic cleanup.

Roles and permissions

Super admin, temple admin and counter staff roles, with fine-grained permissions such as QR collection and report access.

One-time QR collection

Each order’s QR receipt can be redeemed only once at the counter scanner.

Payment reconciliation

Razorpay webhooks are signature-checked, and reconciliation runs every 5 minutes plus a daily sweep, so orders are not lost or charged twice.

Consent and erasure

Consent is captured at checkout, and a buyer’s data can be erased on request (DPDP).

Audit log

Admin actions are recorded in an audit log, with a complaints inbox and refund tracker alongside.

M-of-N committee approvals

Purchases are approved by a committee by value slab, and the person who raised a request can never approve it.

Separation of duties

Stock corrections follow separation of duties, and jewellery is held under two-person custody with verification and discrepancy handling.

Append-only ledger and audit trail

The stock ledger and the audit trail are append-only — entries are added, never edited away.

Private document storage

Documents such as bill photos are kept in private storage, not on public links.

Read-only auditor role

Auditors get a read-only role, and access can be scoped to a unit such as the main temple or the annadanam (free meals) kitchen.

Role and module permissions

Super admin, tenant admin, property, finance and legal staff, plus custom permissions per module and action.

Permission-gated downloads

Documents preview in the browser; downloading needs its own permission.

Audit trail

Actions across properties, documents, rentals and cases are recorded in an audit trail.

Mandatory 2FA for admins

Administrators must sign in with a TOTP authenticator app.

Envelope-encrypted vendor credentials

Carrier and vendor API credentials are stored with envelope encryption.

Masked by default

Phone numbers and email addresses are masked in the console by default.

Consent and opt-out

Consent records, suppression and opt-out lists, and STOP handling for WhatsApp.

DPDP erasure

Supports erasure of a devotee’s data on request under the Digital Personal Data Protection Act, 2023.

Audited impersonation

When support acts inside a tenant’s account, it is recorded in an audit trail. Roles include a read-only auditor.