Security and privacy
You’re sharing suspicious messages with us. Here is how we look after them.
What we keep
- Each check keeps its result and a short, redacted excerpt (card, Aadhaar, PAN, OTP and account numbers are removed).
- The full message text is kept only if you turn that on in Privacy settings, and then it is encrypted.
- Uploaded screenshots, PDFs and recordings are deleted as soon as the check finishes.
- Checks are deleted automatically when your chosen retention period ends (7 to 365 days, depending on your plan). You can delete any check, or your whole account, at any time.
How we protect it
- Passwords are hashed with Argon2id. Sessions use secure, HttpOnly cookies with CSRF protection.
- Sensitive fields and stored files are encrypted at rest.
- Staff accounts must use two-factor authentication, and every administrative action is logged.
- Links are fetched by an isolated service that cannot reach our internal network, private addresses or cloud metadata, so a malicious link can’t be used against us.
- Your family members and teammates can only see what you choose to share.
Who else processes data
Depending on the features you use and how PehleCheck is configured, links may be looked up with threat-intelligence services (such as Google Web Risk, URLhaus or VirusTotal), message text may be sent, after redaction and only with your consent, to an AI provider, and voice notes to a speech-to-text provider. Payments are handled by Razorpay; we never see your card or UPI PIN. The Privacy Policy lists these processors.
Report a vulnerability
If you find a security issue, please tell us privately using the contact page. Please don’t access other people’s data or disrupt the service while testing.