Money and data · promises you can audit

1. Customers' money does not pass through Nava

Our most important principle: Nava never holds a single baht of customers' money. The PromptPay QR code Nava generates for every order is linked directly to the shop's PromptPay number. Money flows from the customer's account to your bank account, with no Nava intermediary.

What this means: even if Nava goes down or goes out of business, your money and your customers' money remain safe, because it was never with us. Nava does not hold a payment business licence and is not required to, because we are not in the business of holding funds.

2. Slip verification against real bank data

Slips that customers submit to Nava are checked through a Thai slip verification provider connected to bank data before the system proposes a 'paid' status for the seller to confirm. We do not decide based on the slip image alone.

What we check:

• Whether the amount matches the amount due
• That the transfer time falls within a reasonable time window
• Whether the recipient really is your PromptPay account
• Whether the reference number matches the bank's data (fake slips usually cannot fake this field)
• Whether the slip has already been used for another order (duplicate-slip protection)

3. Encryption of data at rest and in transit

Data you have Nava store (shop name, phone number, address and customer history) is transmitted over HTTPS/TLS-encrypted connections at the level banks use. On the server side, data is stored in an enterprise-grade database hosted in the Southeast Asia region, with disk-level encryption (encryption at rest).

Connection tokens for LINE, Facebook and Instagram are encrypted before being stored in the database. If the database is accessed without authorization, any tokens obtained could not be used directly.

4. Access permissions: shop owner and staff

Nava separates permissions between the shop owner and staff. Staff can help take orders, reply to chats and pack orders, but only the shop owner can change the PromptPay number.

What this means: if you hire 5 staff members to help handle orders, you don't need to worry that a staff member will change the PromptPay number so that money goes into their own account. Every PromptPay change is recorded in the audit log, together with the name of the person who made it, the date and time, and the old and new values.

5. Authentication and account protection

Nava uses an enterprise-grade managed authentication system for sign-in. It supports:

• Sign-in with mobile number + OTP (for sellers)
• Sign-in with email + password (for test and administrator accounts)
• Session management via JWTs that are verified on every request
• Password changes and account recovery through verified channels

6. Compliance with the PDPA (Personal Data Protection Act)

Nava has been designed to comply with the PDPA from the start. As the shop owner, you are the 'data controller' of your customers' data, and Nava is the 'data processor' that provides the tools.

What we do for the PDPA:

• Slip retention period: automatically deleted after 90 days (kept for your reference)
• Raw message retention period: automatically deleted after 90 days (only order metadata is kept)
• You can export customer data as a CSV file at any time
• You can delete an individual customer's data on request (the right to be forgotten)
• The /data-deletion page provides an explanation and a way to submit requests

7. Incident response

If Nava discovers an incident that may affect the security of your data or your money:

• We will notify you by your registered email address and within Nava without undue delay after confirming the incident, and as required by law
• If it is a personal data breach, we will notify the Office of the Personal Data Protection Committee (PDPC) without undue delay, as required by Section 37 of the PDPA
• Issues affecting payments or slip verification are treated as the most urgent incidents in Nava's internal process

8. AI order drafts: what is sent, and where

Nava uses Anthropic's Claude models to read chat messages and draft orders. Only the chat messages of that purchase are sent (no images, including slip images). Under Anthropic's terms, API data is not used to train models, is deleted within 30 days and is stored in the United States. If Anthropic is unavailable, the system retries later and never sends the chat anywhere else by itself. Only in a long outage may Nava switch on a backup provider (DeepSeek, which stores data in China and may use it to improve its models unless an opt-out is requested, which Nava has done), and it will say so on this page every time. Inside Nava, personal data in AI drafts is deleted automatically after 30 days. A shop's corrections to AI drafts are kept inside Nava to improve accuracy and are not sent to third parties. The AI never confirms a payment, never changes the PromptPay number and never ships for the shop.

9. What we haven't done yet (because transparency matters too)

We have not yet:

• Obtained SOC 2 / ISO 27001 certification (Nava is still new; this kind of certification usually begins once there are enterprise customers)
• Added support for column-level data encryption (other than the tokens mentioned above)
• Added support for separate 2FA for user accounts (we still rely on the OTP of the sign-in method)