How we look after your agency’s data
Your customers’ passports, trips and payments sit in Wolkcle, so here is plainly how they are protected. Everything on this page describes the product as it runs today.
Hosted on Microsoft Azure, in India
Application in Azure South India
The Wolkcle app and its API run on Microsoft Azure in the South India region.
Files in private Azure storage
Photos, vouchers, PDFs and documents are stored in Azure Storage in South India, with public access switched off.
A managed database
Your records are kept in MongoDB Atlas, a managed database service, never on a server we run by hand.
Email sent through Azure
Quotations, invoices and notices are sent through Azure Communication Services, with its data location set to India.
Payments handled by Razorpay
Subscription payments are taken by Razorpay. Your card details go to Razorpay and are never stored by Wolkcle.
Encrypted in transit and at rest
HTTPS everywhere
The app accepts secure connections only, and file storage refuses anything older than TLS 1.2.
Encrypted at rest
Our database and file storage providers encrypt stored data on disk.
Your connection secrets, encrypted again
Credentials you give us for lead sources and connected services are encrypted with AES-256-GCM before they are saved.
Only the right people get in
Passwords are never stored
Only a bcrypt hash of each password is kept, so nobody at Wolkcle can read it.
Verified sign-ups
A new account must confirm its email before the first sign-in, and sign-up is protected against bots by Cloudflare Turnstile.
Lockout after repeated failures
Five wrong passwords lock the account for 30 minutes, which stops password guessing.
Short-lived sessions
Sign-in tokens last 15 minutes and are renewed in the background, in cookies that page scripts cannot read.
15 roles, set per person
Give each team member the role that fits, from owner to accountant to read-only viewer, and they see only what that role allows.
Every agency kept apart
Every record is tied to your agency, and every request is limited to your agency's own data.
Your data stays yours
Deleted when you leave
When an agency closes its account, its data is scheduled for deletion after a 7-day grace period, in case the closure was a mistake.
Privacy by policy
Our privacy policy explains what we collect, why, and your rights under India's Digital Personal Data Protection Act, 2023.
Found a security issue, or running a vendor review?
Write to support@wolkcle.com with “Security” in the subject. Please give us a chance to fix a reported issue before sharing it publicly. Read the privacy policy and terms for the full detail.