Security.

1. Our approach

Wizetrace holds information about your physical assets - purchase bills, warranty cards, insurance policies, and service records - so we treat protecting it as core to the product, not an afterthought. This page summarizes the practical measures behind the Service; it's a plain-language overview, not an exhaustive technical audit.

2. Account security

We don't use passwords. You sign in with a one-time passcode sent to your verified phone number, so there's no password for an attacker to guess, reuse, or leak from a data breach elsewhere. Once verified, your session is secured with a short-lived access token and a longer-lived refresh token, so a stolen access token has a narrow window of usefulness.

3. Encryption

All traffic between your browser or app and our servers is encrypted over HTTPS/TLS - nothing is sent in plain text. Connections from our servers to our database are also encrypted, and data stored in our cloud infrastructure benefits from our provider's encryption-at-rest.

4. Infrastructure

Wizetrace runs on Google Cloud, using managed, auto-patched infrastructure rather than servers we maintain by hand. Credentials, API keys, and other secrets are stored in a dedicated secrets manager rather than in application code, and our database runs on a managed Postgres provider with its own security and backup practices.

5. Access controls

Within an organization, access is governed by roles and permissions - members see and do only what their assigned role allows. Family plan visibility works the same way: a family owner can see their group's devices, but access outside a family or organization's own boundaries isn't possible through normal use of the Service. Administrative actions are recorded in an activity log for audit purposes.

6. Rate limiting & abuse prevention

Every API endpoint - sign-in, device creation, file uploads, and everything else - is rate-limited to reduce the impact of automated abuse, credential-stuffing attempts, and accidental runaway scripts, with stricter limits on sensitive actions like login and account creation.

7. Document & file security

Uploaded files are validated for type and size before they're accepted, and documents (warranty cards, insurance policies, service invoices, purchase bills, pollution certificates) are stored in private cloud storage - they aren't publicly browsable. A device's public QR-scan view is deliberately limited to non-sensitive information and never includes the assigned user's personal contact details.

8. AI processing

Documents sent for AI-assisted data extraction are used only to return structured data back to your device record - they are not used to train AI models. See our Privacy Policy for more detail on how this works.

9. Your responsibilities

Security is shared. You can help keep your account safe by:

• Keeping control of the phone number your account is verified with, and updating it with us if it changes hands.
• Never sharing a one-time passcode with anyone, including someone claiming to be from Wizetrace support.
• Signing out of the portal on shared or public devices.
• Only granting family/organization access to people you actually trust with that data.

10. Reporting a vulnerability

If you believe you've found a security vulnerability in Wizetrace, please report it to support@wizetrace.com with enough detail for us to reproduce it. Give us a reasonable time to investigate and fix the issue before disclosing it publicly, and avoid accessing, modifying, or deleting data that isn't yours while testing. We appreciate responsible disclosure and will respond as quickly as we can.

11. Contact

Questions about our security practices? Reach us at:

• Email: support@wizetrace.com
• Phone: +91 9746463537
• Address: Collective Coworks Phase 2, Kusumagiri, Kakkanad, Kochi, Ernakulam, Kerala, India - 682030