Is AutoMyra ISO 27001 or SOC 2 certified?

No. We hold neither certification today, and we do not display badges suggesting otherwise. The controls that are in place are listed on this page, and we would rather you evaluate those than a logo.

Where is my data stored?

In its own database, separate from every other business on the platform. If you need specifics about hosting region or arrangements for a procurement review, contact us and we will answer directly rather than by publishing a generality.

Can I get my data out?

Yes. Your records can be exported. We do not treat the difficulty of leaving as a retention strategy.

Who can see my data inside my business?

Only the people your roles allow. Permissions are configured per business and control what each user can open, edit, export and delete.

Your business data deserves serious protection.

AutoMyra holds your customers, your sales, your invoices and your employees. This page sets out the controls that are actually in place — not a list of the controls a page like this usually lists.

We do not hold ISO 27001, SOC 2 or PCI certification, and we do not display badges for them. Where a control is not in place yet, it is not listed below.

Data isolation

A database per business — Your data lives in its own database, not in shared tables separated by a column. One customer's query cannot reach another customer's rows, because there is nothing for it to reach.
Isolated cache and queues — Cache keys and background jobs are namespaced per business, so nothing crosses over in transit either.

Access control

Role-based permissions — What a user can open, edit, export and delete follows from the role you assign. Permissions are held per business, so your roles are yours.
Token authentication — API access uses issued tokens rather than shared credentials, and a token can be revoked without changing anybody's password.
Hashed API keys — API keys are stored as a SHA-256 hash. The secret is shown once, at creation, and is never recoverable from the database — including by us.
Widget domain whitelist — The support widget only accepts requests from the domains you list, so your embed code is not usable on someone else's site.

Data protection

Encryption in transit — All traffic to AutoMyra is served over HTTPS.
Field-level encryption — Sensitive employee identifiers — PAN, Aadhaar, ESI and bank details — are encrypted in the database, not merely restricted by permission.
Passwords are never stored — Passwords are stored as a one-way hash, so a database copy does not yield anybody's password.
Retention on assessments — A public Business Health result is reachable only by its link, is excluded from search engines, and is deleted automatically once its retention period is up.

Accountability

Activity logs — Changes to leads, tickets and tasks are recorded with who made them and when, so a handover or a dispute is answered from the record.
Approval trails — HR approvals are workflows with their steps, approvers and outcomes stored — an approval is evidence, not a recollection.
Consent and opt-out — WhatsApp consent and opt-outs are recorded and honoured, which is both a policy requirement and a record you can produce.

Platform

Rate limiting — Public endpoints — the contact form, the health assessment, the widgets — are rate limited by name, so one caller cannot exhaust them for everyone.
Input validation — Requests are validated server-side before they reach your data. Client-side checks are a convenience, never the control.
Your data is exportable — Your records are yours. They can be exported, which is what makes the decision to stay a choice rather than a lock-in.