Security at Grovia

Your invoices, clients and team records are your business. This page says plainly how we look after them — and links to where you can check the details.

Where your data lives

  • Grovia runs on Amazon Web Services in the Asia Pacific (Mumbai) region, India — the application, the database and uploaded files.
  • Each business's records are kept apart in the database: every request is checked against the account it belongs to.
  • The outside services we use, and what each receives, are listed in our privacy policy.

In transit and at rest

  • Every page and API call uses HTTPS. Browsers are told to use HTTPS only (HSTS, two years, including sub-domains).
  • Passwords are never stored — only a one-way bcrypt hash.
  • Sign-in tokens for connected Google and Microsoft accounts, calendar and mailbox connections, webhook signing secrets and Cashfree / PayU keys are encrypted with AES-256-GCM before they are stored.
  • API keys are stored only as a SHA-256 hash; the key itself is shown once, when it is created.

Signing in

  • Two-factor sign-in with an authenticator app.
  • Repeated failed sign-ins from one address are slowed down and then blocked for a while.
  • A changed role or removed permission reaches people who are already signed in within minutes, not at their next sign-in.

Who can see what

  • Owners and admins decide each member's access, module by module, in Settings → Users.
  • Client portal users see only what is shared with them; internal tasks and documents stay internal.
  • The Activity Log records important changes — who did what, and when.
  • API keys carry only the access you tick, and can be revoked at any time.

Payments

  • Card, UPI and bank details are entered on the payment gateway's own page (Razorpay, Cashfree or PayU) — they never reach Grovia.
  • Every online payment is confirmed with the gateway, server to server, before it is recorded.

Backups and your own copy

  • The database and uploaded files are backed up every night and kept for 90 days, in AWS Mumbai.
  • A copy is also taken immediately before every software update.
  • Owners can download a full export of their account at any time from Settings → Backup.

AI features

  • AI features are powered by Anthropic's Claude API. Only what a feature needs is sent, over an encrypted connection.
  • Under our commercial terms, data sent through Anthropic's API is not used to train its models.

Our own practices

  • Software is updated against published security advisories, and a database backup is taken before each update.
  • Webhooks we send are signed (HMAC-SHA256) and only go to public HTTPS addresses — never into private networks.

Found a security problem?

Please tell us privately through the contact page with "Security" in the subject, and give us a chance to fix it before telling anyone else. Live service status is at groviaos.com/status; how we handle personal data is in our privacy policy.

Last reviewed 11 November 2026.