Irsaal keeps each business's data in its own private workspace: staff, riders and customers of one business can never reach another business's records. Every page is served over HTTPS, passwords and login PINs are stored only as one-way hashes, sign-in attempts are limited, and inside your business each staff login opens only the sections its role allows. This page lists what Irsaal Software actually does to protect your data — and what it does not claim.
How is my business's data kept separate from other businesses?
Every record in Irsaal — each customer, order, invoice, payment and rider — belongs to exactly one business. When someone signs in, the software works out which business the login belongs to and from then on reads and writes only that business's records. A staff member or rider of one business has no screen, link or search that reaches another business's data, and a panel page refuses to open at all if no business can be identified for the login.
The same rule applies to the copies of your data: a backup file contains only your business's rows, and a restore refuses a file whose records belong to another business.
How are passwords and sign-ins protected?
- Passwords are hashed. They are stored only in a one-way hashed form, never as readable text — nobody at Irsaal Software can look up your password. Login PINs are hashed the same way.
- The owner's password must be at least 8 characters.
- Sign-in attempts are limited to 5 a minute and 30 an hour from the same connection, so a password cannot be guessed by trying thousands.
- Each sign-in starts a fresh session, and Sign out ends it.
- A deactivated login cannot sign in, even with the right password: "This account has been deactivated."
- Water and LPG riders cannot sign in to the web panel at all. They work only in the Irsaal Rider app, which shows them only their round.
- Password reset links expire after 60 minutes and work once. The reset form gives the same answer whether or not an email address has an account, so it cannot be used to find out who uses Irsaal. Resetting a password also cancels every saved "Remember me" sign-in.
- Verify your email. The profile menu shows Verified or Unverified under your email address; press Verify now to confirm it with a code, so reset links reach an inbox you control.
Who can see what inside my business?
You decide. The owner's login has every permission; everyone else gets a role. In Users & Roles → Roles & Permissions, each section of the software has View, Add, Edit and Delete boxes, plus that section's own actions — so a delivery clerk can record refills without seeing the accounts, and an accountant can read reports without deleting a customer. Staff users, roles and permissions in Irsaal explains every box.
On top of roles:
- Branches. A login posted to one branch sees only that branch's work.
- Rider App Permissions (Settings → Modules) limits which jobs riders may do in the app — collecting payments, adding customers, recording expenses and so on.
- Hide Customer Phone from Riders (Settings → Modules) hides customer numbers and call buttons from the rider app.
Is the connection encrypted?
Yes. The site forces HTTPS: a page asked for over plain HTTP is redirected to HTTPS, so what you type — passwords included — travels encrypted between your browser and the server. Every form in the panel also carries a security token, so another website cannot submit it on your behalf.
Can I see who changed something?
Yes, on plans that include the Activity Log. It records every add, change and delete made in the panel or the rider app: which login did it, when, and what each changed field was before and after. Passwords, PINs and keys are masked in it. Lines are kept for 180 days. Open it from System → Activity Log.
Can I get a copy of my data?
Yes, in two ways:
- Reports. Every report exports to PDF, Excel or CSV for staff whose role allows exports.
- A full backup. On request, Irsaal Software can send your business a complete copy of its data as an Excel workbook, one sheet per table. Passwords, PIN hashes and access tokens are removed from it. Your administrator can put that file back from Import Data → Restore a backup; before a restore replaces anything, the account as it stood is saved on the server and can be put back with Undo for 7 days.
Can Irsaal staff see my account?
To help you, Irsaal Software's support team can open your account and see exactly what you see. Every time support signs in to an account, it is recorded against that account. Support does not know or need your password.
What happens to my data if I stop using Irsaal?
Nothing is deleted when a trial ends or a subscription lapses. The panel closes, but every customer, order and invoice stays where it was, and paying reopens the account. Data from a trial that is not continued is kept for 30 days in case you come back.
To have an account and its data deleted, use the account deletion form. It works without signing in; you confirm the request from an emailed link, a person reviews it, and there is a 14-day cooling-off period before anything is deleted.
Are the links I send my customers safe?
- Invoice links that the rider app shares with a customer carry a signature, so the link opens that one invoice and cannot be changed to open another.
- Delivery proof links use a long random code and open only that one proof.
- The goods transport tracking page masks senders' and receivers' names and phone numbers.
What does Irsaal not claim?
Irsaal is not certified to ISO 27001 or SOC 2, and it does not offer two-factor sign-in today. It is hosted software only: there is no version to install on your own server. If your business needs any of these, please ask before you buy.
Where is Irsaal's security policy?
The company's own statement — including how the platform itself is backed up — is the Security page, and how your data is handled is in Data Processing and the privacy policy.
How do I report a security problem?
Email info@irsaalsystems.com with what you found and how to reproduce it. A security contact is also published in the standard format at /.well-known/security.txt.
Frequently asked questions
Is Irsaal secure?
Irsaal keeps each business's data in its own private workspace, serves every page over HTTPS, stores passwords and PINs only as one-way hashes, limits sign-in attempts and lets the owner decide what each staff login can open. It is not ISO or SOC certified and has no two-factor sign-in.
Can other businesses on Irsaal see my customers?
No. Every record belongs to one business, and a login can only reach the records of its own business.
Can my staff see everything?
Only if you give them a role that allows it. Each role has View, Add, Edit and Delete for every section, and a login can be limited to one branch.
Can I download all my data from Irsaal?
Yes. Every report exports to PDF, Excel or CSV, and on request support can send a complete Excel copy of your business's data, which your administrator can also restore.
Does Irsaal keep backups?
The platform's own backups are described on the Security page. Separately, on request, support can produce a complete copy of your business's data as an Excel workbook, which your administrator can restore from Import Data → Restore a backup — worth asking for before a big change.
What happens to my data when my trial ends?
Nothing is deleted. The panel closes until you choose a plan, and everything you entered is waiting when it reopens. If you do not continue, trial data is kept for 30 days.
Khulasa (Roman Urdu)
Irsaal mein har business ka data alag aur private hota hai — kisi doosre business ka banda aap ka data nahi dekh sakta. Website hamesha HTTPS par chalti hai, password aur PIN hash kar ke rakhe jate hain, aur ghalat login ki koshishen mehdood hain. Apne staff ko aap Users & Roles mein sirf wohi sections dete hain jo zaroori hon. Reports PDF, Excel aur CSV mein download hoti hain, aur support se poore data ki Excel copy mangwai ja sakti hai. Irsaal ISO ya SOC certified nahi hai aur two-factor login abhi nahi hai.