Identity numbers are encrypted, not just hidden

An Aadhaar or PAN number is never stored in a readable column. Each one is held three ways, and only three:

Encrypted, so the stored value is meaningless without the key
The last four digits, so staff can confirm they have the right document
A keyed fingerprint, so the software can tell that two records are the same person without ever reading the number

The interface never returns a full number — not to an owner, not to a manager, not through the API, and not to anyone at PawnEasy Pro. Even with database access, the numbers are ciphertext.

One shop cannot see another

Every record carries the shop it belongs to, and that filter is applied by the system rather than remembered by each screen. A request for your books can only ever return your books, and a URL guessed from another shop's account returns nothing.

Staff see what their role allows

Four roles — owner, manager, accounts and counter. Counter staff take pledges and payments without seeing the whole book; accounts reads payments, reports and customer records but writes no loans; a manager does everything except billing. Every screen checks the role, not just the menu that led to it.

Every entry keeps the name of who made it, and sign-ins are recorded. That is what makes delegation safe.

The trail cannot be quietly rewritten

Custody movements are append-only: an article's history of taken in, put away, moved and released is added to, never edited. A payment is never silently deleted — a mistake is reversed with a reason, and both entries stay in the daybook. A ledger you can edit invisibly is not evidence of anything.

Where it lives

Servers in Mumbai, India
Traffic between your devices and the server is encrypted in transit (HTTPS)
Backups are taken so that a hardware failure is a restore, not a loss
Uploaded photographs — customers, identity documents, articles — are served only to signed-in users of the shop that owns them, never from a public URL

Signing in

Staff sign in with their own mobile number and a one-time password sent by SMS, so an account is tied to a handset the shop knows. Shared logins are the single commonest way small businesses lose control of their data; give each person their own.

What we do not do

We do not sell or share your data, and there are no advertising trackers in the app
We do not use one shop's book to inform another's, or to train anything
We do not send messages to your customers from our number — reminders go from your shop's WhatsApp Business account
We do not hold your card. Google Play takes the payment.

What is yours to do

Security is shared, and the parts below are the shop's:

Give each member of staff their own account and the narrowest role that lets them work
Remove staff who have left, the day they leave
Do not share one handset and one login across the counter
Export your reports periodically — it is your book, and a copy you hold is a good habit

Telling us about a problem

If you think you have found a security flaw, write to vexagate@gmail.com with enough detail to reproduce it. We will confirm we have it, fix what needs fixing, and we will not pursue anyone who reports something in good faith and does not go looking through other shops' data.

If a breach ever affects your records, we will tell you what happened, what was affected and what we did, and notify the authorities where the law requires it.

Data Security