Skip to content
AssuredAccess

Security Policy

How we protect the platform and your data:

  • Transport: TLS 1.2+ on every request; HSTS enabled.
  • Payments: handled end-to-end by PCI-DSS-compliant Cashfree; webhook signatures verified with HMAC-SHA256 before any order is marked paid.
  • Data at rest: license keys and gateway secrets AES-256 encrypted; passwords bcrypt-hashed; database access restricted to private networking.
  • Application: CSRF protection, output escaping (XSS), parameterized queries (SQL injection), strict rate limiting on auth/OTP/checkout endpoints, security headers (CSP, X-Frame-Options, nosniff).
  • Access control: role- and permission-based admin access, 2FA-ready accounts, full audit logging of admin actions.
  • Operations: encrypted offsite backups, least-privilege infrastructure, dependency patching.

Responsible disclosure: found a vulnerability? Email support@assuredaccess.in with subject "Security". Please do not access other users' data or disrupt the service. We acknowledge within 48 hours and do not pursue action against good-faith research.