Security at Drivay

Your account

• Your email address and mobile number are verified when you sign up.
• Passwords must be at least 8 characters with upper- and lower-case letters, a number and a symbol, and we block passwords that have appeared in known data breaches.
• Passwords are stored only in hashed form; nobody at Drivay can see them.
• Repeated failed sign-ins are blocked.
• We email you if we see a sign-in from somewhere unusual.

Payments

Payments, refunds and payouts are handled by our payment partner, Cashfree Payments. Your full card details go straight to Cashfree and never touch our servers. Hosts' payout bank account numbers and UPI IDs are stored with strong encryption and only ever shown masked, for example ra•••@okicici.

Location privacy

• Before payment, spaces are shown by area only, with locations rounded to about a kilometre.
• The exact address and arrival instructions are shared only with parkers who have paid.
• Parkers' locations are shared only around their own bookings, with their permission, and cleared when the booking ends.

At the space

• Parkers check in with a code their host confirms.
• When someone parks for the parker, the host checks a separate guest PIN first.
• Too many wrong codes lock the check-in, so codes can't be guessed.
• Phone numbers, emails and UPI IDs are hidden in messages, so payments stay protected on Drivay.

Our systems

• All traffic uses encrypted connections (HTTPS), and browsers are told to always use them.
• Uploaded photos are checked and re-processed before they're stored.
• Staff access is limited by role, and admin actions are logged.
• Every listing is reviewed by our team before it goes live.

Report a security issue

Found a vulnerability? Email support@drivay.com with the subject "Security report" and the steps to reproduce it. Please give us reasonable time to fix it before sharing it, and don't access other people's data or disrupt the service while testing. We'll reply within 3 business days and keep you updated.