Security
Security for Demat and MeroShare automation
Trust matters when an app helps manage Demat accounts and authorized MeroShare workflows. Lagani Saathi uses passwordless sign-in, keeps sensitive values encrypted and redacted, and runs live MeroShare work only after you confirm.
Passwordless sign-in
Accounts use email codes or optional Google/Facebook — no site password to phish or reuse. Optionally add an authenticator app (TOTP) or a passkey, revoke other devices, and get a new-login email.
Encrypted storage
MeroShare passwords, CRN numbers, transaction PINs, and full Demat numbers are stored using Rails Active Record encryption.
Redacted diagnostics
Logs and audit payloads use safe summaries and suffixes instead of secret values.
User-controlled workflow
Live MeroShare submission requires explicit confirmation before background work begins.
Stay ready
Get issue alerts or share this guide.
Subscribe for IPO and right-share alerts, or send Lagani Saathi to someone who manages family Demat accounts.
FAQ
Common questions
Why is there no password login? + -
Reusable site passwords are easy to phish, reuse, and stuff — a poor fit when an account can hold Demat and MeroShare credentials. Email codes (and optional social sign-in) are the first factor; strengthen with an optional authenticator or passkey.
Do you support two-factor authentication or passkeys? + -
Yes, optionally. Enroll an authenticator app (TOTP) with recovery codes, or a passkey such as Touch ID, Face ID, Windows Hello, or a security key. MFA is optional; we nudge you when you add a Demat account.
Can staff see my MeroShare password or PIN? + -
No. Sensitive credentials are not shown in normal product UI and should not be used for support troubleshooting.
Can I delete my account and data? + -
Yes. Account deletion removes the local account and owned group data, while operational audit rows may remain without user association.
Related guides
Keep exploring the Nepal share workflow.
These public pages explain the connected parts of the Lagani Saathi workflow without exposing private app data.