Security Built Into Every Layer
Rebitto protects company operations through strict multi-tenant scoping, role-based access governance, one-way secret hashing, and signed tokens.
This page documents the active cryptographic, database, and authorization safeguards operating inside Rebitto Business OS in production. We avoid unverified third-party certification badges and report only implemented technical controls.
Implemented Security Controls
Multi-Tenant Row-Level Isolation
Every backend procedure enforces authenticated organizationId boundary checks. Customer contacts, GST invoices, HR files, and warehouse records remain strictly compartmentalized by workspace.
Role-Based Access Control (RBAC)
Owners, Admins, and custom member roles govern access down to individual modules. Financial reports, team management, API keys, and billing preferences remain restricted to authorized administrators.
SHA-256 Hashed Developer Keys
API credentials (reb_live_...) are generated with cryptographic entropy, displayed once on creation, and persisted exclusively as one-way SHA-256 hashes.
HMAC-SHA256 Webhook Integrity
Outgoing webhooks transmit an X-Rebitto-Signature header so external receivers can authenticate origin payloads and defend against tampering or replay.
Signed Offline POS Entitlements
Offline checkout registers validate capabilities through cryptographically signed entitlement tokens bound to terminal IDs and validity windows, preventing client-side tampering.
Immutable Administrative Audit Trails
Critical platform mutations—including subscription updates, role changes, and API key actions—are logged with actor identity, timestamp, and metadata for accountability.
Verified Billing & Payment Gateway Boundary
Razorpay subscription checkout signatures and inbound webhooks are verified via constant-time HMAC-SHA256 checks against raw request payloads, with zero UPI PINs or card details persisted on Rebitto servers.
Have Specific Security Questions?
Reach out to our team if your company needs clarification on workspace isolation, API authentication, or role governance.