Your data. Your domain.

A line the model can’t cross.

Your customer data, your brand assets and your store content are yours outright, and your domain transfers to you on request — under a written export guarantee, no lock-in. And every AI surface we ship sees only what it needs to help: a name and business signals — never a contact number, address, payment detail or ID. That rule lives in the tools themselves, not on a policy page.

Book a founder call See BarhaX live

HMAC-verified paymentsAES-256-GCM at restRLS, deny-all by default

Enforced, not promised

razorpay.webhook

HMAC-SHA256 verified, timing-safe compare

credentials.save

AES-256-GCM — no key, no write, ever

every table

Row-level security, deny-all by default

phone OTP

Rate-limited in the database, 5 / hour

Ask BarhaX anything. It still can't hand back a phone number.

01 · The bright line

Every question BarhaX or the crew answers passes the same server-side gate. It isn't a prompt instruction a clever ask could talk around; it's a check the tools themselves run before they ever emit a field. Here's exactly what makes it across, and what never does.

A question, arrivingsame gate, every store

Customer nameEmail addressPhone numberRTO risk scoreDelivery addressCLV segmentPayment & UPI detailsDelivery-risk bandGovernment IDOrder & cart signalsPasswords

server-side gate — checked on every call

Crosses to BarhaX

Customer nameRTO risk scoreCLV segmentDelivery-risk bandOrder & cart signals

Never leaves your server

Email addressPhone numberDelivery addressPayment & UPI detailsGovernment IDPasswords

BarhaX answers using only what crossed — a name and the signals on the left.

That’s still personal data under India’s DPDP law, and we don’t pretend otherwise. It’s the smallest slice that lets the AI actually help, held to the same bright line on every CharvaX surface: the AI receives a customer’s name and business signals — never contact details, addresses, payment info or IDs. Enforced server-side, because the tools simply don’t emit those fields. Even a cleverly worded ask can’t exfiltrate what was never handed over.

02 · The primitives

The primitives, not the marketing.

Two of these guard money. A webhook can’t be forged, and a payment can’t double-fire even if the network hiccups and retries the request. The third guards the gateway and courier credentials you hand us for your own accounts: encrypted the moment they’re saved, and if the encryption key is ever missing, the save simply fails — it never falls back to storing anything in the clear.

security · verified on every call

◆ razorpay.webhook → hmac_sha256(payload, secret) === signature · timingSafeEqual()

◆ payment.create → idempotency_key already seen → retried, not duplicated

◆ credentials.save → aes_256_gcm.encrypt(secret, KEY) → ciphertext stored

◆ credentials.save, no KEY set → write refused — fails safe, never plaintext

Every table starts closed. You open exactly what's needed.

03 · Deny by default

The database itself won't hand back a row unless a policy explicitly allows it. That's the house rule on every table we've ever shipped, applied at build time, so no one can leave it off by accident.

Deny-all, by default

Every production table ships with row-level security that starts closed. Access is opened row by row, never assumed open.

Public content, approval-gated

Reviews and similar public content become readable once approved, and only then. The table stays shut to wholesale reads and writes.

OTP limits that survive a restart

Five attempts an hour, counted in the database. An in-memory limiter would reset the moment a server did.

Every public token, unguessable

Tracking links, order-claim, coupon codes — all UUIDs. No one finds your order by counting up from someone else’s.

The headers browsers actually check

CSP and HSTS on every response, plus a guard that refuses to redirect anywhere outside the store’s own domain.

Errors, scrubbed before they leave

Local variables are stripped from error reports in production, so a crash can’t accidentally ship a customer’s data with it.

The crew's safety rules aren't settings. They're code.

04 · Guardrails on the crew

BarhaX and every agent in the crew work inside the same three limits, whichever store they're running in. There's no toggle for them at all, in any tier.

Support Triage drafts a reply — it never promises a refund, a credit or a delivery date.

Every customer-facing or irreversible action waits for a human to confirm, on every agent, every time.

BarhaX can read and prep almost anything in your admin, but it never sends a customer a message on its own.

Whether any of them run at all — off by default, nothing scheduled until you switch one on

And whatever an agent reads to make a decision, it reads under the same bright line as BarhaX — a name and the signals it needs, nothing it shouldn’t have.

See the identity gate in the buyer chat

Cancel any time. Walk away with what's actually yours.

05 · Yours to keep

The setup fee buys the store, built and launched. The subscription is for the platform and the AI that run it — and even that comes with a way out if our word alone isn't enough.

Yours, in writing

Customer data — every order, message and profile you’ve collected

Brand assets — your logo, your photography, your copy

Store content — the pages, products and words you publish

Your domain — transferred to you on written request

The subscription, not a cage

The platform, the admin and the crew — the hosted service running on top

Model calls — the AI usage behind the crew, routed and billed for you

Optional source-escrow — ask for it in writing, if our word isn’t enough

Cancel any time — your store keeps running; the crew just stops

None of this lives on a marketing page. It’s a clause in the signed Website Development, Hosting & Services Agreement we send the day you pay, the same document that names exactly which agents touch personal data, for your own DPDP paperwork. Tracking defaults to on so your funnel numbers work; one toggle in the footer opts a visitor out completely and flips Google’s Consent Mode off for them.

Own it. Even the exit.

Live 7, 14 or 21 business days from your build-start date, by plan — or your next two months are free, and we keep building until you launch.

Your customer data, your brand and your domain leave with you if this ever isn’t working. And the AI never had more of your customers than a name to begin with.

Book a founder call See BarhaX live