Your data. Your domain.

A line the model can’t cross.

Storefront code, customer data and the core admin (the store, minus the agent layer) are yours, with a written export guarantee and no lock-in. And every AI surface we ship sees only what it needs to help: a name and business signals — never a contact number, address, payment detail or ID. That rule lives in the tools themselves, not on a policy page.

Book a founder callSee BarhaX live
HMAC-verified paymentsAES-256-GCM at restRLS, deny-all by default
Enforced, not promised
razorpay.webhook

HMAC-SHA256 verified, timing-safe compare

credentials.save

AES-256-GCM — no key, no write, ever

every table

Row-level security, deny-all by default

phone OTP

Rate-limited in the database, 5 / hour

Ask BarhaX anything. It still can't hand back a phone number.

Every question BarhaX or the crew answers passes the same server-side gate. It isn't a prompt instruction a clever ask could talk around; it's a check the tools themselves run before they ever emit a field. Here's exactly what makes it across, and what never does.

A question, arrivingsame gate, every store
Customer nameEmail addressPhone numberRTO risk scoreDelivery addressCLV segmentPayment & UPI detailsDelivery-risk bandGovernment IDOrder & cart signalsPasswords
server-side gate — checked on every call
Crosses to BarhaX
Customer nameRTO risk scoreCLV segmentDelivery-risk bandOrder & cart signals
Never leaves your server
Email addressPhone numberDelivery addressPayment & UPI detailsGovernment IDPasswords
BarhaX answers using only what crossed — a name and the signals on the left.
That’s still personal data under India’s DPDP law, and we don’t pretend otherwise. It’s the smallest slice that lets the AI actually help, held to the same bright line on every CharvaX surface: the AI receives a customer’s name and business signals — never contact details, addresses, payment info or IDs. Enforced server-side, because the tools simply don’t emit those fields. Even a cleverly worded ask can’t exfiltrate what was never handed over.

The primitives, not the marketing.

Two of these guard money. A webhook can’t be forged, and a payment can’t double-fire even if the network hiccups and retries the request. The third guards the gateway and courier credentials you hand us for your own accounts: encrypted the moment they’re saved, and if the encryption key is ever missing, the save simply fails — it never falls back to storing anything in the clear.

security · verified on every call

◆ razorpay.webhook → hmac_sha256(payload, secret) === signature · timingSafeEqual()

◆ payment.create → idempotency_key already seen → retried, not duplicated

◆ credentials.save → aes_256_gcm.encrypt(secret, KEY) → ciphertext stored

◆ credentials.save, no KEY set → write refused — fails safe, never plaintext

Every table starts closed. You open exactly what's needed.

The database itself won't hand back a row unless a policy explicitly allows it. That's the house rule on every table we've ever shipped, applied at build time, so no one can leave it off by accident.

Deny-all, by default
Every production table ships with row-level security that starts closed. Access is opened row by row, never assumed open.
Public content, approval-gated
Reviews and similar public content become readable once approved, and only then. The table stays shut to wholesale reads and writes.
OTP limits that survive a restart
Five attempts an hour, counted in the database. An in-memory limiter would reset the moment a server did.
Every public token, unguessable
Tracking links, order-claim, coupon codes — all UUIDs. No one finds your order by counting up from someone else’s.
The headers browsers actually check
CSP and HSTS on every response, plus a guard that refuses to redirect anywhere outside the store’s own domain.
Errors, scrubbed before they leave
Local variables are stripped from error reports in production, so a crash can’t accidentally ship a customer’s data with it.

The crew's safety rules aren't settings. They're code.

BarhaX and every agent in the crew work inside the same three limits, whichever store they're running in. There's no toggle for them at all, in any tier.

Support Triage drafts a reply — it never promises a refund, a credit or a delivery date.
Every customer-facing or irreversible action waits for a human to confirm, on every agent, every time.
BarhaX can read and prep almost anything in your admin, but it never sends a customer a message on its own.
Whether any of them run at all — off by default, nothing scheduled until you switch one on

And whatever an agent reads to make a decision, it reads under the same bright line as BarhaX — a name and the signals it needs, nothing it shouldn’t have.

See the identity gate in the buyer chat

Cancel any time. Walk away with what's actually yours.

The setup fee buys a store you own outright. The subscription is for the AI that runs on top of it — and even that comes with a way out if our word alone isn't enough.

Yours, in writing
Storefront code — the real Next.js store, exportable
Customer data — every order, message and profile you’ve collected
Core admin — your dashboard, minus the agent layer
Your domain, and what BarhaX has learned about your business
The subscription, not a cage
BarhaX and the crew — the hosted intelligence layer running on top
Model calls — Claude and Gemini usage, routed and billed for you
Optional source-escrow — ask for it in writing, if our word isn’t enough
Cancel any time — your store keeps running; the crew just stops
None of this lives on a marketing page. It’s a clause in the signed Website Development, Hosting & Services Agreement we send the day you pay, the same document that names exactly which agents touch personal data, for your own DPDP paperwork. Tracking defaults to on so your funnel numbers work; one toggle in the footer opts a visitor out completely and flips Google’s Consent Mode off for them.

Own it. Even the exit.

Live in 7 days — or your next two months are free, and we keep building until you launch.

Your storefront code, customer data and domain leave with you if this ever isn’t working. And the AI never had more of your customers than a name to begin with.

Book a founder callSee BarhaX live