Skip to content
Bharat Solar Venture
Log in
Menu

Security and data protection

This page states what Bharat Solar Venture actually does to protect your account and your customers' data, and where the limits are. It covers sign-in, sessions, password resets, and how files and quotation share links are handled. It makes no claims about certifications, because none are held at the time of writing.

Last updated

Accounts and sign-in

  • Passwords are stored as bcrypt hashes, never in readable form.
  • Google sign-in tokens are verified on the server before an account is created or opened.
  • Sign-in, registration, token refresh, password-reset and Google sign-in requests are rate-limited.

Sessions

  • Signing in issues an access token and a refresh token. Refresh tokens rotate each time they are used.
  • If a refresh token that was already used appears again, the whole session family is revoked.
  • Signing out revokes the refresh token on the server, not just in your browser.

Password resets

Reset links contain a single-use token. Only a hash of the token is stored, it expires after a short time, and it cannot be used twice.

Your data and your customers' data

  • Each company's records are isolated: requests are scoped to the signed-in company.
  • Logos, signatures and quotation PDFs are kept in private storage and delivered through short-lived signed links.
  • A quotation's share link carries a random identifier, stops working when the quotation is declined, expires or is superseded, and tells search engines not to index it.

Limits you should know about

  • The web app keeps its sign-in tokens in the browser's local storage. That is common, but it means a script running on the page could read them, so keep your browser and extensions trustworthy.
  • Anyone who has a quotation's share link can open that quotation's PDF. Share it with care.
  • No third-party security certification has been published for the service.

Reporting a problem

A security contact address will be published here before launch.

Common mistakes

  • Sharing a quotation link with the wrong person

    Anyone who has a quotation's share link can open its PDF. Share it with care.

  • Using a browser or extensions you do not trust

    The web app keeps its sign-in tokens in the browser's local storage, so a script running on the page could read them. Keep your browser and extensions trustworthy.

  • Sending a link that no longer opens

    A share link stops working when the quotation is declined, expires or is superseded, so send the link of the current version.

  • Assuming a certification exists

    No third-party security certification has been published for the service.

What to check before you send

  • The link goes only to the customer it is meant for
  • The quotation is not declined, not expired and not superseded by a revision, so the link will open
  • You are on a browser and extensions you trust
  • You signed out on a shared computer, which revokes the refresh token on the server

Cite this page

Bharat Solar Venture. "Security and data protection." Bharat Solar Venture, last updated 11 Oct 2026. https://bharatsolarventure.in/security

Canonical URL: https://bharatsolarventure.in/security

Create your account