Security and Vulnerability Disclosure

Last updated 4 November 2026

Businesses keep their books in Ziwake, so we take its security seriously. If you believe you have found a security vulnerability, please tell us. This page says what is in scope, how to report, what we ask of you and what you can expect from us. It is provided by Ziwake.

Scope

• In scope: ziwake.com and its subdomains, including the website, the web app, the help centre, the free tools, shop pages and the API, and the Ziwake Android app.
• Out of scope: services run by others that we use, such as our hosting provider, payment gateway, e-mail, SMS and WhatsApp providers and Google sign-in. Please report those to their owners.
• Also out of scope: reports from automated scanners without a working proof; missing best-practice headers or version banners without a real security impact; issues that need a rooted or jailbroken device, physical access to a device, or an out-of-date browser; denial of service; spam; and social engineering.

How to report

• E-mail security@ziwake.com. Tell us what you found and where (the address or the screen), the steps to reproduce it, the impact you think it has, and your name or handle if you would like to be thanked.
• Write in English or Hindi. Do not send other people's personal data. If you saw any, tell us what kind of data it was, not the data itself.
• Our machine-readable contact details are at ziwake.com/.well-known/security.txt.

What we ask of you

• Test only with your own account and a business you created for testing. Do not view, change, download or delete data that is not yours beyond the minimum needed to prove the issue. If you reach someone else's data, stop and tell us.
• Do not run denial-of-service or load tests, or anything that slows the Service down or interrupts it for others. Keep any automated testing gentle and within our rate limits.
• Do not use social engineering, such as phishing or calls to our team, and do not attack our staff, partners, customers, providers or premises.
• Use a vulnerability only as far as needed to show it. Keep it confidential, and give us reasonable time to fix it before you tell anyone else (see Disclosure, below).
• Do not demand payment or make threats, and follow the law.

Safe harbour

If you act in good faith and follow this page, we treat your research as authorised by us under our Acceptable Use Policy and the Information Technology Act, 2000. We will not take legal action against you, or ask the police to act against you, for that research, and if someone else does, we will make it known that we authorised it. This does not cover anything that breaks the rules above, and we cannot authorise testing of services that others own. Nothing on this page limits what the law requires us to report, for example a cyber incident to CERT-In; if we must report something you found, we will say that you reported it to us in good faith.

What you can expect from us

• We acknowledge your report, usually within 3 working days, tell you whether we can reproduce the issue, and keep you informed until it is fixed.
• We fix the most serious issues first and as quickly as we can.
• With your permission, we thank you by name or handle once the issue is fixed.

Disclosure

Please give us 90 days from your report to fix the issue before you publish any details, or less if we tell you it has been fixed. If we need longer, we will tell you why and agree a date with you.

No bug bounty

We do not run a paid bug bounty and cannot pay for reports. We are grateful for every good-faith report all the same.

Other reports

To report misuse of the Service, unlawful content or a privacy concern rather than a vulnerability, write to our Grievance Officer: Grievance Officer, grievance@ziwake.com.