Security
Your records, kept private, on record and yours to take.
What Qlomack does to protect your business data, what each control means for you, and what your business still reviews itself.
What we do
Built into the platform
We don’t claim certifications we haven’t obtained. This page describes the controls built into the platform. If your organization needs a security questionnaire answered, contact us.
Each business’s data kept apart
Every request is checked against your membership of the organization, and the database itself enforces row-level security, so a query without the right organization returns no data.
What this means for you: Your records are seen only inside your organization, with a second lock in the database, not only in the screens.
Roles and custom roles
Six built-in roles: Organization Owner, Organization Admin, Manager, Employee, Accountant and Viewer. Owners and admins can build custom roles from the permissions they hold. Billing and ownership stay with owners.
What this means for you: Each person sees and changes only what their work needs.
Guide: invite your team and choose rolesBranch limits
Anyone can be limited to certain branches. They see records in those branches, plus records that belong to no branch, and cannot save a record into another branch.
What this means for you: A branch manager works with their branch’s records, not the whole business.
Guide: branch access and the audit logTwo-factor sign-in
Each person can turn on two-factor sign-in with an authenticator app and gets 10 one-time recovery codes. Authenticator secrets are stored encrypted and recovery codes only as hashes. Organizations cannot yet require it for their members.
What this means for you: A stolen password alone is not enough to get into an account that has it on.
Guide: password, two-factor authentication and sessionsSign-in protections
Passwords need at least 12 characters and are stored only as one-way Argon2id hashes. Sign-in attempts are rate limited, with a progressive lockout after repeated failures. Sessions end after inactivity and after a maximum lifetime, and resetting a password signs out every device.
What this means for you: Guessing passwords is slow, and you can sign out a lost phone or laptop from your account.
Audit log with IP address
Important changes are recorded with who made them, when, what changed and the IP address. Owners and admins can view it. Entries cannot be edited or deleted, and are kept for the life of the organization.
What this means for you: You can always answer “who changed this, and when?”
Guide: check the audit logPrivate documents, short-lived download links
Uploaded documents, generated reports and data exports are kept in private storage. A file opens only through a signed link that expires shortly, issued after checking that the person may see it.
What this means for you: Only people allowed to see a record can open its files, and a forwarded link soon stops working.
Encrypted integration credentials
Keys and passwords for services an organization connects, such as webhook signing secrets, are stored encrypted.
What this means for you: The keys you give Qlomack for other services are not stored in readable form.
Encrypted connections
The website, the app and the API are served over HTTPS (TLS), and sign-in cookies are sent only over secure connections.
What this means for you: What you type and see travels encrypted between your browser and Qlomack.
Nightly backups
The database is backed up every night, each backup is checked when it is made, and backups are kept for 14 days by default. Restores are tested.
What this means for you: The service can be recovered after a failure. Backups do not bring back single records you delete, so keep your own exports too.
Privacy Policy: how long data is keptExport everything, any time
Owners and admins can export the whole workspace as one ZIP with a CSV file for each kind of record, with uploaded documents if they want. Lists and reports export CSV files too, even while a workspace is read-only.
What this means for you: Your data is never locked in. Keep your own copies whenever you like.
Guide: export your dataLimited staff access
Running the platform does not give Qlomack staff access to your business data by default. Staff use it only where needed for support you ask for, to keep the service secure, or where the law requires. The staff admin portal needs two-factor sign-in.
What this means for you: Nobody at Qlomack browses your records.
Read the Privacy Policy
Who does what
What Qlomack handles, and what your business still reviews
Qlomack prepares, calculates, reminds and records. Decisions, filings and approvals stay with you and your accountant.
| What Qlomack handles | What your business still reviews |
|---|---|
| GST returns and e-invoices | |
| Prepares the GSTR-1 JSON file, GSTR-3B figures, a GSTR-2B reconciliation, and e-invoice and e-way bill JSON from your invoices. | You or your CA review them and upload them on the government portal, then record the IRN and QR code back. Qlomack files nothing directly. |
| Payroll | |
| Calculates monthly payroll with PF, ESI, professional tax and TDS from the rate tables in the product, and produces payslips, the PF ECR file and statutory reports. | You or your accountant confirm the rates, ceilings and slabs, approve each pay run and upload the files on the government portals. |
| Backups and copies | |
| Backs up the database every night and keeps backups for 14 days by default. | Export your own copies of important data when you want them. Backups are for recovering the service, not single records you delete. |
| Access | |
| Enforces the roles, permissions and branch limits you set, and records important changes in the audit log. | Decide who is invited and what they can do, remove people who leave, and look at the audit log from time to time. |
| Sign-in | |
| Offers two-factor sign-in to everyone, protects passwords and limits sign-in attempts. | Each person turns two-factor on, keeps their recovery codes safe and uses a strong password. |
| Tally | |
| Exports your masters and vouchers as a Tally XML import file, and imports Tally groups, ledgers and opening balances. | Your accountant imports the file into Tally and checks it. There is no live connection: Tally runs on your own computer. |
| Licences and renewals | |
| Tracks licences, certificates and renewals with owners, due dates and reminders. | Make the renewals and keep the business compliant. Qlomack does not guarantee legal compliance. |
| Importing records | |
| Checks every row before anything is saved, and updates records that already exist instead of adding duplicates. | Look over the check and fix the rows marked as problems. |
Found a problem?
Report a security issue
If you think you have found a security weakness in Qlomack, email us with what you found and the steps to reproduce it. Please don’t open, change or delete other people’s data while you look, and give us a reasonable time to fix it before you tell anyone else.
support@qlomack.comFor questions about personal data, see the Privacy Policy and the Data Processing terms.
See the controls for yourself.
Start a free trial, invite a colleague with a narrow role and look at the audit log. No card needed.