Security Policy
How Debryx protects your data and maintains platform security.
Last updated:
Overview
Debryx takes the security of your data seriously. We implement defence-in-depth security measures across application, network, infrastructure, and organisational layers. This policy outlines the security controls we have in place to protect the Debryx platform and your data.
Security Safeguards
Encryption at Rest
All PII fields encrypted with AES-256-GCM. Encryption keys derived from NEXTAUTH_SECRET via SHA-256.
Encryption in Transit
TLS 1.3 enforced for all API and web traffic. HSTS enabled in production.
Access Control
Role-based access control (RBAC) with Site Engineer, EHS Officer, Manager, Admin, and Contractor roles.
Authentication
Argon2id password hashing. Optional Google OAuth. Session management via secure HTTP-only cookies.
Rate Limiting
Distributed rate limiting via Redis. Per-IP and per-account throttle. Account lockout after 10 failed attempts.
Audit Logging
Immutable audit trail for all waste batch operations. User activity logging for security events.
Input Validation
Zod schema validation on all API inputs. CSRF protection. Host header validation in production.
Dependency Scanning
Automated dependency audits via npm audit. Pre-commit hooks for security linting.
Application Security
Secure Development Lifecycle
- Code reviews for all changes before deployment
- Automated security linting in CI pipeline
- Dependency scanning and vulnerability alerts
- Regular penetration testing by independent security firms
API Security
- All API endpoints protected by authentication and authorisation
- Input validation via Zod schemas on every endpoint
- CSRF token validation on state-changing requests
- Rate limiting per endpoint (login: 5/15min, general: 100/15min)
- Host header validation prevents host injection attacks
Authentication & Session Management
- NextAuth v5 with Credentials and optional Google OAuth providers
- Passwords hashed with bcrypt (cost factor 12)
- Session tokens stored in encrypted HTTP-only cookies
- Session revalidation on privilege escalation events
- Account lockout after 10 consecutive failed login attempts
Infrastructure Security
Hosting & Network
- Application hosted on Docker containers with minimal attack surface
- Read-only container filesystem with limited tmpfs mounts
- Database not exposed to the internet; internal Docker network only
- Automated health checks and container restart policies
Monitoring & Incident Response
- Centralised logging with Pino (JSON format, no PII logged)
- Real-time security event monitoring via user activity logs
- Automated alerts for unusual access patterns
- Incident response plan with defined escalation procedures
Data Protection
- Encryption at rest: AES-256-GCM for PII fields (GSTIN, PAN, phone)
- Encryption in transit: TLS 1.3 for all traffic
- PII redaction in logs, activity records, and error responses
- Automatic data retention and purging as per regulatory requirements
- No sensitive data in client-side bundles or source maps
Vendor Security
We carefully evaluate third-party vendors who process data on our behalf. Our vendors (including Cloudinary for image storage, Vercel for hosting, and Redis for caching) maintain SOC 2 or equivalent security certifications. Data Processing Agreements are in place with all sub-processors.
Compliance
- Compliant with India’s IT Act, 2000 and SPDI Rules, 2011
- GDPR readiness for European customers (DPA available on request)
- C&D Waste Management Rules, 2016 compliance for waste records
- CPCB guidelines for EPR and waste reporting
Security Contact
If you discover a security vulnerability, please follow our Responsible Disclosure Policy. For security inquiries, contact security@debryx.in.