Security

What's actually in place, not generic marketing claims.

Passwords and OTP

• Passwords are hashed with scrypt and a random per-account salt; we cannot read your password, only verify it.
• OTP codes are 6 digits, stored only as a salted HMAC (never the code itself), expire in 5 minutes, allow 5 tries, and are rate-limited to 3 sends per 10 minutes per mobile number.
• Repeated wrong passwords temporarily lock the account rather than allowing unlimited guessing.

Sessions and API keys

• Web sessions use a random token in an HttpOnly, SameSite=Strict cookie (Secure over HTTPS); only a SHA-256 hash of the token is stored server-side.
• Each desktop app install gets its own API key; only its hash is stored, and losing a PC just means revoking that one key - it doesn't affect your other PCs or your password.
• Every state-changing request must be JSON, and browser requests are checked against the site's own origin (CSRF protection).

Transport and infrastructure

• qcok.in is served only over HTTPS, with a certificate issued by Let's Encrypt and renewed automatically.
• The server runs in India (Bangalore), behind a firewall that only allows web (80/443) and SSH, plus automatic banning of repeated failed login attempts at the network level.
• Uploaded logos are validated by their real file signature (PNG/JPEG), not just the filename, and size-limited.

Payments

We never see or store your card, UPI or bank details. Payments (once switched on) are handled entirely by Razorpay, a RBI-regulated payment aggregator; webhook notifications are verified by signature before any credit is added.

Data retention

Account/profile data is kept for as long as your account is active, plus whatever period GST and other Indian law requires us to retain invoices and business records after that. Seller KYC/consent records captured in the desktop app when buying a device (the seller's consent to QC testing, data wipe and ID photo storage) are kept permanently and cannot be deleted by anyone, including after the device is resold - this exists specifically to protect shops and sellers if a device's history is ever disputed later. Wipe-process logs and IMEI blacklist checks are likewise append-only and cannot be altered or deleted once recorded.

Reporting a security issue

Found a problem? Please tell us before telling anyone else, at qcok.in@gmail.com.