Security and your data
Where your visitor data is stored, who can reach it, how sign-in is protected, and an honest list of what we do not claim.
This page describes how VizPass handles your data. It is written for the person who has to sign off on a new system — so it states what is actually in place, and is equally clear about what is not.
Where your data is stored
VizPass runs on infrastructure hosted in India, in a Mumbai region data centre. Visitor records, photographs and identity details captured at your gates do not leave Indian infrastructure in the course of normal operation.
Each customer's data is separated at the database level: every record carries the company it belongs to, and queries are scoped to that company. One customer's staff cannot reach another customer's visitor register.
Data in transit
The whole application is served over HTTPS. Specifically:
- HSTS is enabled with a one-year max-age, including subdomains, so browsers refuse to fall back to an unencrypted connection.
- Content-Security-Policy restricts where scripts and resources may load from.
- X-Content-Type-Options: nosniff stops browsers guessing file types.
- X-Frame-Options: SAMEORIGIN prevents the application being framed by another site.
- Referrer-Policy: strict-origin-when-cross-origin limits what is leaked in referrer headers.
- Permissions-Policy grants the camera and location only to VizPass itself and blocks the microphone entirely — the camera is needed for visitor photographs and ID capture, the microphone never is.
Accounts and sign-in
- Passwords are stored using bcrypt. They are never stored in a form that can be read back, by us or by anyone else.
- Session cookies are Secure (HTTPS only), HttpOnly (not readable by JavaScript) and SameSite=Lax, which blocks the common cross-site request pattern.
- Sessions expire after a period of inactivity rather than lasting indefinitely.
- One-time passcodes are supported for verification flows.
- Debug mode is off in production, so application errors never expose internal details to a visitor.
Who can see what
VizPass ships with seven roles — Super Admin, Company Admin, Security Head, Security Guard, Receptionist, Manager and Employee — governed by 57 individual permissions.
This matters more than it sounds. A guard at the gate needs to check someone in without being able to export the full visitor history; a manager approving a visit does not need to change company settings. Permissions are granted per action, so each person gets exactly the access their job needs.
Backups
The database is backed up automatically every night, and the most recent 14 days are kept, with older copies pruned automatically. Backups are compressed database dumps, and the schedule is monitored — a heartbeat records every run, so a backup that stops running is visible rather than silently absent.
If you need a restore, ask us and we will tell you exactly which point in time we can restore to before we do anything.
Audit trail
Actions taken in the system are written to an activity log with the user and timestamp attached. When someone asks who changed a setting, admitted a blocked visitor, or exported a register, the answer is a record rather than a recollection.
Your visitor register itself is exportable to CSV at any time, so your records are yours and not locked inside the product.
Deleting your data
If you stop using VizPass, a purge routine permanently removes a company and all of its data — not a flag marking it hidden, an actual deletion. Ask us and we will run it and confirm when it is done.
Visitor data is personal data. Collect what your site genuinely needs at the gate, and display a notice telling visitors what you are collecting and why. VizPass does not currently capture a visitor consent record for you, so that notice is something you put at the gate — see DPDP and visitor data for what sits with you and what sits with us.
What we do not claim
We would rather be useful to your review than impressive in it:
- We are not ISO 27001 or SOC 2 certified. If a certification is a hard requirement for your procurement, we do not currently meet it.
- We do not publish a third-party penetration test report, because we have not commissioned one.
- We do not claim to be "DPDP compliant". Compliance depends on how you configure collection, notice and retention at your own gates as much as on the software. We can walk through what the product does and where your obligations sit.
If a supplier tells you their software makes you compliant with a data protection law, ask them to show you the clause that does it.
Reporting a security issue
If you believe you have found a vulnerability, email [sales@beyondboxai.com](mailto:sales@beyondboxai.com) with the detail and we will come back to you. Please give us a reasonable opportunity to fix it before disclosing it publicly.
Talk to us
BeyondBoxAI Technologies Pvt. Ltd.
5th Floor, Tower B, The Corenthum, C Block, Phase 2, Sector 62, Noida, Uttar Pradesh 201301, India
Email [sales@beyondboxai.com](mailto:sales@beyondboxai.com) or call [+91 81304 68801](tel:+918130468801). If your security team has a questionnaire, send it over — we will answer it honestly, including the questions where the answer is no.
See also our privacy policy and terms.
The agreement behind this page
Everything above is written into a Data Processing Agreement that forms part of our Terms: our role as your data processor under the DPDP Act, 2023, the security measures we commit to keep, a 72-hour breach-notification promise, how retention, export and deletion work, and the full sub-processor list with locations. It downloads as a PDF for your procurement file.
Security questions we are asked
Where is our visitor data stored?
On infrastructure hosted in India, in a Mumbai region data centre. Visitor records, photographs and ID details captured at your gates do not leave Indian infrastructure in normal operation.
Can another customer see our visitors?
No. Data is separated at the database level — every record carries the company it belongs to and queries are scoped to that company. There is no shared visitor register.
Is VizPass ISO 27001 or SOC 2 certified?
No. We hold no security certification and do not claim one. If certification is a hard procurement requirement, we do not currently meet it. We would rather tell you that now than during an audit.
Is VizPass DPDP compliant?
We do not make that claim, because compliance depends on how you configure collection, notice and retention at your own gates as much as on the software. VizPass does not capture a visitor consent record today; what it does provide is configurable collection, role-based access, export and permanent deletion on request. See DPDP and visitor data for who is responsible for what.
Can a security guard export our whole visitor history?
Only if you grant that permission. There are seven roles and 57 individual permissions, so a guard can check visitors in without holding export or settings access.
What happens to our data if we leave?
You can export your register to CSV at any time. On request we run a purge that permanently removes your company and all of its data — an actual deletion, not a hidden flag — and confirm when it is complete.