Payment Policy
Comprehensive terms detailing payment collection methods, Razorpay gateway integration, cryptographic verification, and strict credential security.
Policy Directory
Avyan Bakehouse adheres to a strict zero-credential retention policy. When you enter payment details, you interact directly with the PCI-DSS Level 1 compliant infrastructure provided by Razorpay. Our servers, databases, and logs never capture, record, or store full 16-digit card numbers, card expiration months/years, 3-digit CVV codes, net banking passwords, or UPI MPINs.
1. Accepted Methods of Payment
Avyan Bakehouse accepts a comprehensive range of digital payment options for online checkout and wallet top-ups:
Google Pay, PhonePe, Paytm, BHIM, CRED, and all NPCI-supported UPI apps via QR code or direct intent.
RuPay, Visa, MasterCard, and American Express cards issued by recognized Indian banking institutions.
Direct internet banking from over 50 leading Indian banks (HDFC, ICICI, SBI, Axis, Kotak, etc.).
Instant deduction from your registered patron wallet for morning bread subscriptions.
2. Payment Aggregator Relationship
Online payment collection is facilitated by Razorpay Software Private Limited, an RBI-authorized Payment Aggregator. Please note:
- Razorpay acts as the technical payment transmission and acquiring intermediary.
- Razorpay does not manufacture or sell bakery goods and does not guarantee our food produce. Avyan Bakehouse remains exclusively responsible for the quality, delivery, and customer service of all bakery items.
- Under no circumstances does Avyan Bakehouse claim that "Razorpay endorses or guarantees our internal store credit wallet." Razorpay provides standard payment gateway routing to process your wallet top-up transactions.
3. Server-Side Order Authorization & Cryptographic Verification
To protect patrons from price tampering and fraud, every transaction undergoes stringent multi-stage verification:
- Server-Side Pricing: Delivery fees and product subtotals are verified on our servers (`OrderService`, `DeliveryPricingService`). Browser prices cannot be altered by malicious scripts.
- Cryptographic Signature Matching: Upon checkout completion, our backend verifies the Razorpay signature using a timing-safe HMAC SHA256 algorithm (`hash_equals()`). An order is marked as `confirmed` and `paid` only when the cryptographic signature matches the secret hash.
- Webhook Fallback & Deduplication: If your browser connection disconnects before redirection completes, our automated webhook endpoint (`/webhooks/razorpay/payment`) validates the payment signature independently and credits your order or wallet ledger without duplicate debits.
4. Payment States & Disputed Transactions
In case of payment authorization timeouts or bank network failures:
If funds were deducted from your bank or UPI app but the website displayed a failure screen, do not panic. This occurs when bank-to-gateway confirmation packets experience network latency. If our webhook cannot confirm settlement within 30 minutes, the issuing bank automatically triggers an Auto-Reversal, restoring funds to your account within 5 to 7 business banking days. For detailed steps, visit our Payment Failure & Auto-Reversal Information Page.