VANINXT MICRO Retention and Security

Access and tenant isolation

• Passwords are salted and hashed with a server-side secret and are never displayed.
• Identity and company are resolved from the authenticated session; browser-supplied company identifiers are not trusted.
• Only one active session is allowed, with an eight-hour maximum and a three-minute recovery window after unexpected closure.
• The phone app can keep a shop signed in until the user signs out. Its device key is unlocked with Face ID, Touch ID, fingerprint or face unlock, or the phone's screen lock, opens a normal session, is replaced on every use and stops working after sign-out, a password change or 90 days without use. Only its hash is stored.
• Continue with Google or Apple uses a one-time state and nonce, checks the provider's signed token and opens the same kind of normal session. Round-trip records last minutes; the link between a Google or Apple account and a MICRO account is kept until the account is deleted, when Apple sign-in access is also revoked.
• Company business records are stored in routed tenant D1 databases and queried by authenticated company identity.
• Uploaded files use private, company-scoped R2 object keys; public bucket access is not enabled.

Operational records

Central D1 stores identity, subscription, routing, lifecycle and security-relevant audit metadata. Tenant business payloads are not copied into Central operational audit views. Passwords and raw business payloads are excluded from logs.

Verification records

Email codes expire after five minutes with at most five verification attempts. A successful code yields a single-use setup proof valid for two minutes. The scheduled cleanup removes expired challenge and rate-limit metadata after a one-day buffer; aggregate sending-budget counters are kept for seven days. Completed setup retry proofs are erased after their 24-hour recovery window. Minimal enrollment and manual access-approval metadata remains with the account and is covered by its approved export/deletion process. Unfinished setup remains inactive pending safe retry or support review. No code or password is stored in browser storage by the signup page.

Retention and deletion

Retention is limited by purpose, contract and applicable law. Import CSV/XLSX payloads and any supporting OCR PDF or image are private, company-scoped, copied to recovery storage and automatically due for deletion after seven days; minimized batch and approval metadata may remain for audit. Company deletion begins by blocking access and revoking sessions, then requires independent Founder approval and verified execution of a complete Central, tenant and R2 manifest. The current canary does not promise automatic one-day erasure. Required security, tax, contractual or dispute evidence may be retained for its lawful period.

Munimji records

Munimji, the optional AI helper, is off until a Company Admin turns it on. The conversation is not stored on our servers, except the words that led to a preview a user changes by hand; it stays in the user’s browser tab or app screen until that is closed. The shop’s Munimji setting and name, the notice acceptance, credit balance and history, prepared previews, daily usage counts and records of hand edits (the words that led to the preview, which AI prepared it, and each change) are kept with the account and erased with it; edit records are also deleted by a workspace reset. An unsaved preview stops working after 30 minutes and is deleted the next time Munimji prepares a preview for the shop, or with the account. A supplier bill photo or PDF given to Munimji is used only to read it and is not kept on our servers afterwards; the purchase preview made from it is kept like other previews, and an edit record keeps the bill’s file name. The AI services keep request content, including bills, under their own terms: Cloudflare does not keep it after answering, Anthropic keeps it for a limited period under its business terms, while DeepSeek keeps it in China for as long as our DeepSeek account exists, and deleting a MICRO account does not delete what DeepSeek already holds. Munimji never writes business records by itself: the normal billing services save a record only after the user taps Save.

Document reading controls

Document reading is optional and deterministic. Up to ten PDF pages, JPG, PNG or WebP files are read in the user’s browser. The interface shows recognised text and every allowed template field for correction. Figure fields reject alphabetic characters, server validation is repeated, and the customer must separately confirm the source document, figures and final save. OCR output is never treated as authoritative and never posts stock automatically.

CERT-In operational archive gate

Customer controls

The customer controls authorised users and entered business data. VANINXT MICRO does not automatically send accounting entries, payments, tax filings or employment decisions to an external system.

Incident handling

Security incidents are triaged using minimum necessary operational evidence. Affected customers and authorities are notified as required by applicable law and verified incident scope.