BharatPe

Fintech Startup BharatPe Automates Security with Cloudflare

Fueled by ultra-low mobile data prices, inexpensive smartphones, and 4G penetration, mobile data consumption in India skyrocketed 56-fold between 2014 and 2018. It was against this backdrop that Bhavik Koladiya co-founded BharatPe, a merchant payment processing company aimed at more than 10 million small and medium-sized businesses (SMBs) in India that don’t have an Internet presence.

BharatPe empowers these merchants by offering them a single interface through which they can accept any payment apps — over 150 of which are available in India — at no cost to the business. All merchants need to do is sign up, download a single QR code for their customers to scan, and start accepting payments, which are transferred directly into their bank accounts. Electronic deposits are an enormous convenience in rural India, Koladiya notes, because the nearest bank could be 20 miles away.

Cyberattacks force other engineering projects to the back burner

Cybersecurity has been a central concern for Koladiya since BharatPe’s early days, in part because the platform came under attack as soon as it launched. “Every day, we were getting pummeled with attacks from Russia, from China, from everywhere,” he explains. “The hackers just kept coming, targeting our open APIs with SQL injections and brute force attacks.”

These attacks impeded BharatPe’s ability to scale effectively as the platform took off. Within a year of launching, they had onboarded over 2.5 million merchants, and had gone from processing 300 transactions per day to processing over 1.5 million. Yet the company’s engineers kept being pulled into time-intensive security projects like identifying their attackers’ IPs, a task that took nearly three months. “Literally half of my back-end team’s focus was going into preventing cyberattacks,” Koladiya says. “Everything else had to go on the back burner.”

These attacks also risked something equally important as growth: customers’ trust. “Vendors rely on us to make their living,” says Koladiya. “Typical high-growth startups usually focus on scale first, and then security, but we’re in the payment business. Security has to come before scale.”

Cloudflare security solutions provide peace of mind and time to scale business needs

Koladiya was assembling a four- to five-person team that would be dedicated solely to fending off cyberattacks when a business associate told him about Cloudflare. He was initially skeptical that anyone could solve his massive security problems with an automated solution, but agreed to a meeting.

“They showed us what their WAF (web application firewall) could do, and we were very impressed,” he recalls. “It looked like it could solve our problems immediately.”

It did. Koladiya and his team went from being locked in a constant battle with hackers to watching the Cloudflare WAF lock cybercriminals out. “Since we implemented the WAF, we haven’t devoted a single man-hour to fixing a security problem,” Koladiya says.

Thrilled with the immediate results they saw with the WAF, BharatPe began investigating how Cloudflare’s solutions could be implemented in other areas of the business. For example, BharatPe is building a new platform for shoppers that will allow them to perform a location search for merchants that accept certain apps. This process will require BharatPe to expose their database, which makes them vulnerable to automated data scraping attacks.

“With Cloudflare Bot Management, we won't have to worry about that,” says Koladiya. “Instead of trying to configure the code ourselves, we can incorporate Bot Management and focus on building a product that users will love.”

In addition to strengthening BharatPe’s security, Cloudflare has dramatically minimized the time it takes to onboard new banking partners. “Before partnering with Cloudflare,” Koladiya says, “it took the team nearly three months to integrate one API with a bank. Now, it takes less than a week.”

A single point of contact to call anytime — even at 3 a.m.

Extreme time zone differences can present a big challenge when international companies decide to partner with Silicon Valley firms; as Americans prepare for sleep, Indian companies are just starting their day. Koladiya says that Cloudflare stands out in this area as well.

“We have a single point of contact that we can call in the middle of the night for technical support,” he says. “If my engineers are having a problem at 3:00 a.m., they can’t wait for an office to open at 9:00 a.m. Pacific Time. Having a contact that I can pick up the phone and talk to at any time of the day or night is huge.”

Koladiya is a veteran in the startup space and has worked with other vendors, but he says he would recommend Cloudflare over the competition without hesitation.

“If a startup founder came to me and said they were worried about security or scale, I would tell them to partner with Cloudflare. Cloudflare knows what they’re doing. You can just let them do what they're good at, and you can focus on the things that you’re good at.”