How we keep you secure

1Data encryption

All traffic between you and Tulittle is protected with industry-standard TLS encryption. Sensitive data is encrypted at rest, and secrets such as passwords are hashed using strong, salted algorithms — never stored in plain text.

2Infrastructure & backups

Tulittle runs on reputable, security-hardened cloud infrastructure. We perform automated daily backups with redundancy, so your catalogue, orders and invoices are safe against accidental loss.

3Access control & authentication

• Granular, role-based permissions let you control exactly what each staff member can see and do.
• Multi-factor authentication (MFA) adds a second layer of protection to logins.
• Sessions are monitored and can be revoked; suspicious activity triggers safeguards.

4Payment security

Payments are processed by PCI-DSS compliant gateways (such as Razorpay). Tulittle never stores full card numbers or CVVs — sensitive payment data is handled directly by the provider.

5Monitoring & audits

We log key actions with an audit trail, monitor our systems continuously, and apply security updates promptly. Access to production data is restricted and reviewed.

6Your responsibilities

• Use a strong, unique password and enable MFA.
• Give staff only the permissions they need.
• Keep your devices secure and log out on shared computers.

7Reporting a vulnerability

Found a security issue? We appreciate responsible disclosure. Please email [email protected] with details, and we'll investigate promptly. Please don't publicly disclose issues before we've had a chance to fix them.