Security at Kritiverse

Logging in

• Log in with a one time code on WhatsApp or SMS, with Google, or with a password.
• Codes expire within minutes and work once. Too many wrong tries pause logins for a while.
• Passwords are stored only as a hash, checked against lists of leaked passwords.
• You can turn on two-step verification with an authenticator app.

Keeping your session safe

• Settings lists every device where you are logged in. Log out one, or all at once.
• We alert you about logins from a new device.
• Changing your phone, email, password or payout UPI, or deleting your account, asks you to confirm again.

Payments

Payments run through Razorpay's checkout. Our server sets every price, and credits are added only after Razorpay confirms the payment.

Your files and personal data

• Uploads and creations sit in private storage. Download links are made only after we check the file is yours, and they expire quickly.
• Phone numbers, email addresses and payout details are encrypted in our database.
• You can export your data or delete your account from Settings. The Kritiverse privacy policy explains what we keep and for how long.

Who at Kritiverse can see what

Staff use a separate admin site with a two-step code every session. Each person sees only what their role needs, phone numbers and emails are masked, and every admin action goes into an audit log that cannot be edited.

Behind the scenes

Cloudflare filters attacks and bots before they reach our servers. Daily backups are encrypted and test restored every month. An outside security firm tests Kritiverse before launch. If a breach ever affects your data, we tell you without delay and report it as Indian law requires.

Report a vulnerability

Test only with your own accounts, do not keep anyone else's data, do not run denial of service tests, and give us time to fix it before you share it. Spotted a fake site or account using our name? See the official Kritiverse channels. For complaints about content, write to the grievance officer.