Security and privacy at Kiauth OVSE

• The full Aadhaar number is never stored, logged or transmitted — only the last four digits in UIDAI’s reference
• If a full Aadhaar-shaped number is ever entered, it is rejected before it is saved
• The Aadhaar QR, ZIP file and share code are checked on our own servers and are never sent to any outside service
• Old-style Aadhaar QR codes that contain the full number are refused

Every guest record belongs to one property, and the database itself enforces that a user can only reach the properties they belong to. Staff at one hotel cannot see another hotel’s guests.

All data is stored in India (Mumbai). Data is encrypted in transit, and passport numbers for foreign guests are additionally encrypted field-by-field (AES-256-GCM).

Sensitive actions — verifications, setting changes, access to guest data — are written to an append-only audit log that owners can review. Entries cannot be edited or deleted from the app.

• The app can lock behind a device PIN when staff step away
• Check-ins saved offline are sent as soon as the connection returns; if one is rejected, its Aadhaar file and share code are wiped from the device immediately
• Error reports are scrubbed of Aadhaar-shaped numbers before they leave the device, and screen recording is never used

The guest register is a record hotels are required to keep, so it can’t simply be deleted on request. Kiauth handles erasure as scheduled minimisation: personal details no longer needed are reduced and removed on a schedule, while the register itself is kept for as long as the law requires.

Questions about how guest data is handled? Email support@kiauth.com.