Payment Security

1. Overview

Ghurio™ takes the security of your payment information seriously. This page explains the technical safeguards and processes we use to protect every transaction made on the Platform.

2. Payment Processors

Ghurio partners with RBI-authorised, PCI-DSS certified payment processors to handle all transactions on the Platform. Depending on the product and payment method selected at checkout, your payment is processed by one of the following:

When you click "Pay" on the Ghurio checkout page, a gateway selection modal allows you to choose your preferred processor. You are then interacting directly with that processor's secure checkout environment — a separate, PCI-compliant context. Ghurio's servers receive only a tokenised confirmation of payment success or failure, never the raw card data.

By completing a payment on the Platform, you also agree to the terms of service and privacy policy of the applicable payment processor. Ghurio is not responsible for any issues arising within the payment processor's own environment.

3. Encryption in Transit and at Rest

In transit

All communication between your browser and Ghurio's servers is encrypted using TLS 1.2 / TLS 1.3 (Transport Layer Security). This is the same encryption standard used by banks. You will see a padlock icon in your browser address bar and the URL will begin with https://. HTTPS-only connections are enforced — unencrypted HTTP requests are never accepted.

At rest

Your account data and booking records are stored with encryption at rest. Access is restricted by strict per-user access controls — no one can query another user's data, even internally, without a valid authenticated session.

4. 3D Secure & OTP Authentication

All card transactions on the Platform go through 3D Secure (3DS2) authentication — the RBI-mandated additional authentication step where your bank sends a one-time password (OTP) to your registered mobile number before the payment is authorised.

This means that even if someone obtained your card details, they could not complete a payment on Ghurio without access to your registered phone.

UPI transactions are authenticated through your UPI PIN via your UPI app (Google Pay, PhonePe, Paytm, etc.) — Ghurio never handles or sees your UPI PIN.

5. No Card Data Stored by Ghurio

Ghurio does not store your card number, expiry date, or CVV on our servers at any point.

When your payment is processed, we receive a payment ID and a confirmation of success/failure from the payment processor. This payment ID references the transaction in the processor's secure vault, not the underlying card data. Our invoice and booking records contain only the payment ID and the last 4 digits of the card (where applicable), which are non-sensitive and industry-standard for receipts.

If you save a card for faster checkout, it is tokenised and stored within the payment processor's PCI-compliant vault — never on Ghurio's servers.

6. Fraud Prevention

Ghurio and its payment processors employ multiple layers of fraud detection:

• Velocity checks — unusual patterns of rapid successive transactions trigger automatic review
• Device fingerprinting — the processor's fraud engine analyses device characteristics to detect anomalies
• IP and geolocation monitoring — transactions from high-risk geographies or mismatched locations are flagged
• ML-based fraud detection — machine learning layers built into each processor's checkout environment

If a transaction is flagged as potentially fraudulent, it may be declined or require additional verification. This is done to protect you.

Chargebacks

If you believe a charge on your statement is fraudulent, contact your bank immediately to initiate a chargeback. Also notify us at [email protected] so we can investigate from our side and cooperate with your bank.

7. Your Responsibility

Security is a shared responsibility. To protect your account and payments:

• Use a strong, unique password for your Ghurio account
• Never share your login credentials, OTPs, or UPI PIN with anyone — including people claiming to be Ghurio support
• Ghurio support will never ask for your full card number, CVV, or UPI PIN
• Log out of your account on shared or public devices
• Keep your registered phone number up to date so OTPs reach you
• Check your bank/card statements regularly

8. Report Suspicious Activity

If you notice:

• An unauthorised charge on your card or bank account referencing Ghurio
• A login to your Ghurio account you do not recognise
• A suspicious email or message claiming to be from Ghurio asking for payment or personal details

Contact us immediately:

We treat all security reports as high priority and will respond within 24 hours.