A tiffin app holds customers' prepaid money and personal details, so we treat it that way. Your platform runs in accounts you own, access is enforced in the database itself, and every rule about money is checked on the server — then tested by trying to break it.
TifTif protects each business's data by running it in the business's own database account, enforcing who can see and change what at the database level, moving wallet money only through checked server-side functions, backing the database up daily, and testing the platform with 125+ automated tests and a security review that attempted real abuse cases.
Each business gets its own database and hosting, in its own name. Your customers' data is never mixed with another business's.
Row-level rules decide what customers, riders, staff and owners can read or change — so hiding a button is never the only protection.
Orders, refunds, top-ups, rewards and adjustments run as checked database functions. The app can never write a balance directly.
Quantities, discounts and similar values are bounded in the database, so a tampered request is rejected even if it gets past the app.
Customers sign in with their phone number and a one-time code. Signing out on one device does not sign them out everywhere.
The database runs on a plan with daily backups kept for seven days.
Before selling TifTif, we reviewed it the way a dishonest customer would: every way to get food or money without paying. Each weakness we found was reproduced against a live database to prove it was real, fixed at the database level, and covered by an automated test so it cannot quietly return.
If you believe you have found a security weakness in TifTif, please email hello@tiftif.co.in with the subject "Security report", and include enough detail for us to reproduce it. Please do not access other people's data or disrupt a live service while testing. We will acknowledge your report and keep you informed as we fix it.
In a database in your own account with the database provider (Supabase), set up in your name during setup. It is not shared with other TifTif clients.
We access your platform only to set it up and to support you, and only with your permission. Because the accounts are yours, you control and can remove that access.
The wallet is a record of prepaid credit; the actual money sits in your own merchant account. Balances change only through checked server-side functions, and the database is backed up daily.
Yes. 125+ automated tests run against a live database, both Android apps are tested on real phones, and a security review in September 2026 tested abuse cases, each now covered by a test.
See all four apps working with live orders before you spend anything.