Security
What protects your account and your records
The controls MSME Exchange has in place today, stated plainly, and what it does not claim.
Your money never passes through us
Subscription money goes from the investor to the issuing company’s own bank account. We are not in the payment path, and the system refuses to record investor money as held by the platform.
Two-factor sign-in
Any account can turn on two-factor sign-in with an authenticator app. It is required for administrators and compliance staff, who can see and approve more than anyone else.
Closed unless deliberately opened
Every page of the signed-in app and every request to the API needs a signed-in account, unless it was deliberately made public. Nothing public names a company, a raise or a figure.
Documents, and who opened them
A company’s documents can be opened by the company, the reviewer assigned to it, and, for diligence documents, investors who have committed money to it. Every opening is recorded with the capacity it was made in, and the company can see that record.
Identifiers encrypted at rest
PAN, bank account numbers and demat client IDs are stored encrypted, so a copy of the database alone does not reveal them.
An audit trail that cannot be quietly changed
Significant actions are written to an audit trail that cannot be edited or deleted. Each entry is sealed into a hash chain, so a change made behind the application’s back can be detected.
Two people for the irreversible
Reversing an allotment needs a second administrator to approve it, and the database checks that they are two different people.
A pause that never traps a refund
Staff can pause new money movements for one company, or for the whole platform, while something is investigated. A pause never blocks a refund.
What we do not claim
MSME Exchange holds no security certification and claims none. No system is free of risk, and nothing on this page is a promise that nothing will go wrong.
Your data, and reporting a problem
You can ask for a copy of your personal data, for it to be corrected, or for it to be erased, through the privacy request page. How we use it is in the privacy policy.
If you find a security problem, please tell us at our support address — not yet published rather than testing it against other people’s accounts.