Accounts
Passwords are bcrypt-hashed. Expiring server-managed sessions, secure cookies, session limits, logout controls, email verification, validation, rate limiting, and security headers add protection.
Files and integrations
Files use a private Amazon S3 bucket with time-limited authorized access. Google Drive access is read-only, consent-based, and its connection credentials are encrypted at rest.
Payments
Razorpay processes payments. DataDock verifies signed responses and webhooks and does not store complete card, bank, UPI PIN, or OTP information.
Report a vulnerability
Email rajatpndey257@gmail.com with reproducible details. Do not access or disclose other users’ data or perform denial-of-service testing. No internet service can guarantee absolute security.