Security
How LoftRay keeps builders’ data secure
Built like a bank, because it handles your money. LoftRay holds your buyers’ PAN and Aadhaar, your receipts and your RERA account, so it works the way financial software should: personal data encrypted field by field, each company sealed off, an audit log nobody can edit, and a second person on refunds, purchases and withdrawals.
Controls
How does LoftRay protect your data?
Six controls built into the product, not added on top.
Personal data encrypted
Names, phone numbers, PAN and Aadhaar are encrypted field by field with AES-256-GCM, using a key for each customer held in a separate vault.
Each company sealed off
Database row-level security keeps every customer’s records apart, even on shared servers.
An audit trail nobody can edit
The audit log is append-only: no one, not even an administrator, can change or delete an entry.
A second person on money
Discounts, refunds, cancellations, purchase orders, RA bills, budget overruns and RERA withdrawals go through approval chains.
Rules signed off twice
Tax, TDS, payroll and RERA rules, payment plans and templates are signed off by a second person before they are used.
Strong sign-in
Passwords are stored with Argon2id, staff sign in with two factors, and rotating encryption keys needs two-factor sign-in too.
In detail
What happens to a buyer’s PAN in LoftRay?
It is encrypted before it is stored, with a key that belongs to your company alone and lives apart from the data.
Buyer record
Name, phone, PAN and Aadhaar entered at booking.
Encrypted per field
Each personal field is sealed with AES-256-GCM using your company’s key.
Stored apart
The database stores the sealed value, never the plain one; row-level security keeps companies apart.
Keys in a vault
Keys sit in a separate vault, and rotating them needs two-factor sign-in.
DPDP
Is LoftRay ready for the DPDP Act?
The Digital Personal Data Protection Act, 2023 sets out how businesses must handle personal data. LoftRay keeps the records the Act asks for, so you can show what you did and when.
Consent notices and history
What each person agreed to, and when.
Access and erasure requests
Requests from buyers and staff to see or erase their data, tracked to completion.
Breach register
A record of any personal-data breach and how it was handled.
Legal holds and retention
Retention runs remove data that is no longer needed, except records under a legal hold.
Questions
Questions about security
Is personal data encrypted in LoftRay?
Yes. Personal data such as names, phone numbers, PAN and Aadhaar is encrypted field by field with AES-256-GCM, using a separate key for each customer. The keys are held in a separate vault.
Can someone change the audit log?
No. The audit log is append-only. Entries cannot be edited or deleted, by anyone, including administrators.
Is LoftRay ready for the DPDP Act?
LoftRay includes the records the Digital Personal Data Protection Act, 2023 asks a business to keep: consent notices and history, access and erasure requests, a breach register, legal holds and retention runs. Your own policies and processes still need to follow the Act.
Does LoftRay hold ISO 27001 or SOC 2 certification?
Not today. This page describes the controls built into the product; we will list certifications here when we have them.
Keep reading
Related pages and guides
See your own project in LoftRay
Tell us about your projects and we will set up a 30-minute demo with your towers and payment plans, not generic sample data.