Security and your data

ExportEazy holds your buyers, prices, invoices and payments. This page says plainly what we do to protect them — and what we do not do yet.

Who can see what

• Roles are checked by the server, not just hidden on screen. Each person has a role in each company — Admin, Accounts, Operations Head, Quality Officer or Packer — and every request is checked against it.
• Floor staff never receive your prices. For roles without access to money, prices, invoice totals and payments are removed from what the server sends, so they are not in the browser at all.
• Companies are kept apart. Every record is scoped to your company through your account’s membership; the address a page is opened on is never used to decide whose data it shows.

Signing in

• Passwords are stored as salted scrypt hashes, never as the password itself.
• The session cookie cannot be read by scripts on the page and is sent only over HTTPS.
• Changing or resetting your password signs out every other session.
• Repeated wrong passwords are slowed down, per account and per network.

Your CHA, forwarder, lab and buyers

• Partners get a link to one task — a Shipping Bill, a BL draft, a lab report — and see nothing else in your account. No login, no paid seat.
• Each link expires (14 days unless you choose otherwise), can be stopped at any time, and every open is recorded. We store only a fingerprint of the link, not the link itself.
• Files sent through a link are checked by their contents — PDF, JPEG or PNG, up to 10 MB — and wait for you to accept them before they touch a record.

Documents

• Documents you upload — certificates, lab reports, Shipping Bills, packs — are stored in our database, not in a public file store, and are served only to people allowed to open them.
• When you share a document with a buyer, it goes by a private link that expires after 14 days, can be stopped, and counts how often it was opened. These pages are marked so search engines do not index them.
• Product photos and your logo are kept in cloud file storage, because they are shown on your documents and to your buyers.

A record of changes

Changes to orders, invoices, payments, lots, products, shipments and partner links are recorded with who made them, when, and what changed. Anyone who can open the record can read its history; money is left out for people who may not see it.

Where it runs

• The application and its database run on DigitalOcean in Bengaluru, India.
• The database is reachable only from our application server, over a private network, with encrypted connections.
• Everything is served over HTTPS; the server’s firewall allows only web traffic and our own administrative access.

Recovery and limits

We do not currently claim scheduled, independently stored database backups or a tested recovery time. If recovery assurance is important to your team, contact us before placing business-critical records here. We will update this page when those controls are operating and have been tested.

Your data is yours

• You can download your registers (invoices, receivables, Shipping Bills), your buyer list, your packing lists and every document you uploaded at any time. On Exporter and Pro, sales, credit notes and receipts download as a Tally import file.
• A single export of everything, and deleting your company’s data, are not self-serve yet: write to hello@exporteazy.com and we do it for you.
• If your plan ends, your data is kept. Anything over the Free plan’s limits becomes read-only rather than deleted.

What ExportEazy does not do

ExportEazy does not connect to ICEGATE, DGFT or a GST portal, and never asks for a government-portal password. It does not file anything on your behalf.

Reporting a problem

If you think something is wrong — a page showing data it should not, or a link that should have stopped working — write to hello@exporteazy.com or call +91 90081 08650. We reply within one working day. See also our privacy policy and terms.