Data encrypted in transitHTTPS / TLS 1.2+
Passwords hashed with Bcrypt10-round salt
JWT session authHS256 signed
Signed file accessCloudflare R2 signed URLs
Audit logsAll critical actions tracked
Content Security PolicyEnforced site-wide
HSTS preloadHTTPS enforced on all subdomains
Built for DPDP Act 2023India data protection law
Data exportYour data, always
Authentication & Access Control
- JWT-based authentication with configurable expiry (8-hour sessions)
- Automatic inactivity logout after 12 hours of idle time
- Secure password policy enforcement: 8+ chars, uppercase, lowercase, digit
- Bcrypt password hashing with 10 rounds salt
- OTP-based account verification on registration
- Secure invite-token flow for user onboarding
- Role-based access control: SuperAdmin, Dept Head, Manager, User
- Per-route permission enforcement on the server
- Organization suspension controls for contract violations
Session Management
- Active session tracking per user and per device
- Force-logout any session from the Platform console instantly
- Platform admins can terminate suspicious sessions org-wide
- Session records include IP address, user agent, and location
- Suspicious session detection and flagging
- Tab isolation per user — sessions never cross between accounts on shared devices
Infrastructure & Data
- Hosted on Neon (serverless PostgreSQL) with encrypted connections
- All API communication over HTTPS / TLS
- Database connections pooled via Neon's built-in pgBouncer
- Environment secrets managed via server-side environment variables
- File uploads stored via Cloudflare R2 (S3-compatible) with signed URLs
- No plaintext secrets stored in client-accessible code
- Webhook payloads verified with HMAC signature before processing
- Content Security Policy restricts which scripts, frames and connections the site may load
- HSTS with preload — HTTPS enforced across the domain and its subdomains
- Clickjacking protection and MIME-sniffing prevention on every response
- Referrer-Policy limits how much of a URL is disclosed to third parties
Real-time Security
- Socket.IO connections authenticated with the same JWT
- Org-scoped socket rooms — users only receive events for their organization
- WebRTC signaling validates participants before relaying offer/answer
- Meeting rooms auto-terminate when all participants leave
- No peer-to-peer data relayed without server-side participant validation
- User-authored rich text sanitized against an allowlist before it is stored
Audit & Compliance
- Comprehensive audit log for all critical actions (login, role changes, deletions)
- Audit logs include actor, target, IP address, and user agent
- Platform admins can review audit logs in the admin console
- Organization-level email logs for all system-sent emails
- Billing event history retained for invoice audit purposes
- Soft-delete pattern for user records — a disabled user keeps their data and can be restored
- Your data is exportable at any time — you are never locked in
API Security
- All API endpoints require authenticated Bearer tokens
- Organization context validated on every authenticated request
- Rate limiting and request validation at the middleware layer
- Cross-origin access restricted to a fixed allowlist of known origins
- Webhook endpoints protected with HMAC signature verification
Responsible Disclosure
Found a security issue? We take all reports seriously. Please contact us privately before disclosing publicly and we'll respond within 48 hours.
Report a vulnerability