Encryption & secrets
What Kapda Stock encrypts — traffic in transit, passwords, payment keys, WhatsApp and AI-calling tokens, 2FA secrets — and how to handle your own credentials safely.
In transit#
All traffic between your browser and Kapda Stock uses HTTPS (TLS), and HTTP Strict Transport Security tells browsers never to connect without it.
Passwords#
Passwords are never stored in readable form. They are hashed with bcrypt, so even Kapda Stock staff cannot see them. Password-reset codes are stored only as hashes and expire after 10 minutes.
Secrets you enter#
Credentials you give the app are encrypted with AES-256 before they are stored, and are never shown again after saving:
| Secret | Entered in |
|---|---|
| Razorpay Key ID, Key secret, Webhook secret | Settings → Razorpay keys |
| WhatsApp (Meta) access token | Settings → WhatsApp Business |
| Retell AI API key | AI Calls |
| Two-factor authentication secrets | Set up at login — see Security & two-factor auth |
To replace a saved secret, type the new value; leaving the field blank keeps the current one.
Sessions#
- Your sign-in uses a short-lived access credential kept in the browser's memory, renewed automatically through a secure, HTTP-only cookie.
- Renewal credentials rotate on every use, and removing a member revokes them immediately.
- A browser that passes 2FA is remembered for 30 days through a separate secure cookie.
Good practice for your credentials#
Related#
Last updated 15/09/2026