Security

How we protect your CashBoo account and data. CashBoo is a product of Algomise Technologies LLP.

Authentication. Sign-in is through Google only. We never see, receive or store your password. Sessions use signed tokens issued by our servers that expire and refresh automatically, and you can revoke CashBoo’s access at any time from your Google Account permissions page.

Data in transit. All traffic runs over HTTPS with TLS 1.2 or higher. The app blocks cleartext traffic entirely, so no data leaves your device unencrypted.

Data at rest. Data is stored in Google Cloud SQL (asia-south1, Mumbai), encrypted at rest. Production access is restricted to a small number of engineers through Google Cloud IAM, and all access is logged.

Access rules. Our servers check every request against the signed-in account — you cannot read or change another user’s data, even with a valid sign-in. Reward crediting, redemption and balance changes happen server-side; the app cannot write its own balance.

Fraud defences. VPN and proxy detection, root and tamper detection, device fingerprinting, and velocity checks on earning and redemption. Offerwall and survey completions arrive as signed server-to-server postbacks verified against a shared secret, so a reward cannot be faked from a device.

Payout safeguards. UPI IDs are validated with Razorpay before release, UPI payouts are reviewed by our team before they are sent, and gift cards are issued through GiftPort. We never store your UPI PIN, bank password or card details.

Infrastructure. Google Cloud Platform (ISO 27001, SOC 2 Type II certified). Automated backups every 24 hours retained for 30 days. Crash reports have personal data scrubbed. Security advisories affecting our dependencies are patched within 48 hours.

No system is perfectly secure, but we take these measures seriously and review them regularly.

Found a vulnerability? Email security@cashboo.in with steps to reproduce. We ask for reasonable time to fix before public disclosure, and we offer a thank-you reward for valid, impactful reports.

Read the full Privacy Policy.