Security at petboard

• A new password needs 10 or more characters.
• We refuse new passwords that are very common or were leaked from other websites.
• You can turn on two-step login. Then each log-in also needs a code from an authenticator app on your phone, like Google Authenticator. To turn it on, log in and open Security. On a phone it is under More, just above Log Out. On a computer it is at the bottom of the menu.

• petboard only works over a secure (HTTPS) connection.
• Our database provider encrypts the data it stores.
• Each business sees only its own data. We test this automatically. Before a code change goes live, a test logs in as one business and tries to open another business's records. A change that fails this test is not released.

• When a client pays you online through petboard, they pay on Razorpay's page. Their full card number goes to Razorpay, never to petboard.
• If you connect your own Razorpay account, we store its secret keys encrypted.
• Before we mark any payment as paid, we check that the message really came from Razorpay. A message that fails this check changes nothing.

• We keep security logs for 365 days. We started this store on 4 November 2026.
• Every day we check the number of failed log-ins, and we get an alert when there are too many.

If a data breach affects your clients' personal details that you keep in petboard, we tell you without undue delay. This is clause 9 of our Data Processing Addendum. If it affects your own account details, we tell you as Indian law requires. We also report to CERT-In, India's cyber security agency, when Indian law requires it.

How we handle personal data: Privacy Policy.

Email hello@petboard.in with what you found and the steps to see it. We read every report.

Please do not open, change or keep data that is not yours, and do not run tests that slow petboard down for others. Security researchers can also find our contact details in a standard file, security.txt.