Administration
How the books are protected
A cooperative's books are public money. These protections are part of how BastraLekha is built — enforced by the database and the software, not left to people remembering rules.
The books
| Protection | How it is enforced |
|---|---|
| Money is exact | Amounts are stored as exact decimals to four places, never floating-point |
| Debits equal credits | The database refuses to save any voucher that does not balance |
| Posted books are never edited | The software has no permission to change or delete a voucher, ledger entry or audit record; corrections are reversals |
| Numbers without gaps | Invoices, credit notes, challans and vouchers are numbered in sequence per branch and year |
| Closed periods stay closed | Nothing posts into a locked period; reopening is a separate authority |
Access
- Each cooperative's data is walled off by the database itself (row-level security), so one organisation can never read another's, even through a bug in a screen.
- Permissions are checked on the server for every request, by one evaluator; the screens only reflect what it allows.
- Sessions live on the server. Signing out, a password change or deactivation ends them everywhere; a stolen refresh token that is reused revokes the whole session.
- Sign-in is rate-limited — 60 attempts per five minutes from one address — and an account locks after eight failed attempts.
Accountability
- Every change is in the audit trail with who, when, from where, and before and after.
- Risky actions need a second person — see separation of duties.
Personal data
- No Aadhaar number is accepted anywhere, and only the last four digits of a weaver's bank account are kept — in line with the Digital Personal Data Protection Act 2023.
- Data stays in India, and is used only to deliver the service. See the data charter.