Security
Your business data, protected by design
Your accounts are your business. HisabMate keeps every business's data separate, lets each staff member do only what you allow, saves every rupee exactly once and keeps a record of every change.
October 2026 security notice
The PHP “php2shell” flaws do not affect HisabMate
On 21 October 2026 PHP fixed two critical flaws (CVE-2026-109618 and CVE-2026-109619, known as php2shell) that can let an attacker run code on unpatched PHP servers. HisabMate does not use PHP or WordPress anywhere, so these flaws do not apply to it.
What happened, and four checks for your current softwareHow we protect it
Six layers of protection
Separate data for every business
Each business has its own data. The database checks which business a user belongs to on every read and every save.
Permissions enforced in the database
View, create, edit, delete, print, ledger and view-all rights per module — checked on the server, not only on the screen.
Every payment saved exactly once
Each payment carries a unique key, so a double tap or a dropped connection never records it twice.
All-or-nothing documents
A sale, purchase or payment saves its money and stock together, or not at all. Excel imports save the whole file or none of it.
Everything on record
Deleted documents, price changes and every entry by every user stay on record, with who did it and when.
Encrypted connection
The website, the web app and the Android app talk to the server over HTTPS.
Roles
Each person sees their own work
Start from these roles or make your own. Rights are set per module, and the database applies them on every request.
Owner
Sees everything: profit, cash, every ledger and every report.
Manager / Admin
Runs the day — purchases, stock and staff — with the rights you choose.
Salesman
Books orders and sales for his own customers, in only the modules you open to him.
Recovery officer
Sees only the customers on his own routes and records what he collects.
Audit trail
Know who did what, and when
Four reports, each with print, PDF and CSV.
- 01
Deleted Documents
What was removed, by whom, and what was on it.
- 02
Price Changes
Which price moved on which item, from what to what, and who moved it.
- 03
User Activity
Every document entered, who entered it and when.
- 04
Users & Access
Who can get in, what they can reach, and when they were last here.
FAQ
Questions
Is HisabMate affected by the October 2026 PHP (php2shell / CVE-2026-109618 & CVE-2026-109619) vulnerability?
No. HisabMate does not use PHP, WordPress or shared-hosting PHP scripts. It runs on a modern non-PHP stack with separate data per business, permissions enforced inside the database and all-or-nothing transactions.
Can another business see my data?
No. Every business on HisabMate has its own separate data. The database itself checks which business a user belongs to on every read and every save.
Can my staff see sales, profit or customers I have not allowed?
Staff see only what their role allows. You set view, create, edit, delete, print, ledger and view-all rights per module, and the database enforces them — not just the screen.
What happens if the internet drops while a payment is being saved?
Every payment carries a unique key, so a double tap or a retry after a dropped connection saves it exactly once. Money and stock changes are all-or-nothing: either the whole document is saved or none of it is.
Can I see who deleted a bill or changed a price?
Yes. The Deleted Documents report shows what was removed, by whom and what was on it. The Price Changes report shows which price moved, from what to what, and who moved it. User Activity shows every document entered, by whom and when.
Is the connection to HisabMate encrypted?
Yes. The website, the web app and the Android app all talk to the server over an encrypted HTTPS connection.
How do I know who has access?
Every user has their own login and a role you choose. The Users & Access report shows who can get in, what they can reach and when they were last here.
Roman Urdu
Kya October 2026 wale PHP (php2shell) security bug se HisabMate ko koi khatra hai?
Nahi. HisabMate mein PHP ya WordPress bilkul istemal nahi hota, is liye yeh bug is par laagu nahi hota. Aap ke karobar ka khata, stock aur qist ka record har business ke liye alag rehta hai.
Kya mera data mehfooz hai?
Haan. HisabMate mein har business ka data alag rehta hai, aur database khud check karta hai ke user kis business ka hai. Staff sirf wahi dekhta hai jis ki aap ijazat dein.
Salesman ko munafa ya doosre customers na dikhein, yeh kaise karein?
Har role ke liye har module par view, edit, delete, print aur ledger ki ijazat alag set karein. Yeh ijazat database ke andar lagti hai, sirf screen par nahi.
Internet band ho jaye to payment do dafa to save nahi hogi?
Nahi. Har payment ki apni unique key hoti hai, is liye double tap ya dobara try karne par bhi payment sirf ek dafa save hoti hai.
Bill kis ne delete kiya, kaise pata chalega?
Deleted Documents report mein likha hota hai kya delete hua, kis ne kiya aur us mein kya tha. Price Changes aur User Activity reports bhi mojood hain.
Run your business with confidence
Free trial — no card, no advance payment. Pay only when you are satisfied.