Security

How we protect your data

• Encryption. All traffic uses TLS. The database (Neon), file storage (Cloudflare R2) and secrets store (Google Secret Manager) encrypt data at rest.
• Access control. Every request is authenticated; each account's data is isolated by account. Team members have roles (admin, accountant, viewer, CA), and billing, profile and team settings are owner-only. API keys are stored only as hashes and can be revoked at any time.
• Files. Vault documents are downloaded through short-lived signed links, never a permanent public URL.
• Abuse protection. Rate limiting on all endpoints with stricter limits on AI and PDF generation, validated inputs, webhook URLs restricted to public HTTPS addresses, and signed webhook payloads.
• Payments. Card and UPI details are handled entirely by Razorpay (PCI-DSS Level 1); we never see or store them.
• Accountability. An activity log records who did what (Business plan), secrets are kept out of source control, deployments run through an automated pipeline, and staff access is limited to what is needed.
• Resilience. The database keeps point-in-time backups with our provider; application servers are stateless and restart automatically.

If something goes wrong

We maintain an incident-response plan. If personal data is affected we will tell the people concerned without undue delay and notify authorities where the law requires — CERT-In within 6 hours of becoming aware of a reportable cyber incident, the Data Protection Board of India, and EU/UK authorities within 72 hours where the GDPR applies.

Report a vulnerability

Please email hello@infraforgeconsulting.com with the details, steps to reproduce and your contact information. We acknowledge reports within 2 working days. Please give us reasonable time to fix an issue before disclosing it, avoid accessing other people's data, and don't run denial-of-service or social-engineering tests. We won't take legal action against good-faith research that follows these rules. Our machine-readable contact is at /.well-known/security.txt.