Security & Trust

Security is foundational to CoreLayerEngine. This page summarises how Ektasi Technology Private Limited protects your data. (It describes our practices and is not a warranty; see our Disclaimer.)

Data protection

• Encryption in transit: TLS with HSTS across the platform.
• Passwords: hashed with scrypt and a per-user salt — never stored in plain text; verified in constant time.
• Signed sessions & CSRF protection on every state-changing request.

Payments

All card payments are processed on our providers' own hosted checkout pages (Stripe, Razorpay, Cashfree, Paddle, Lemon Squeezy). Card numbers never touch our servers, keeping us to the lowest PCI DSS scope (SAQ A). Webhooks are signature-verified.

Application security

• Strict Content-Security-Policy, X-Content-Type-Options, frame-deny, and other hardened headers.
• Upload validation by true file type (magic bytes) — executable/SVG/script uploads are rejected.
• Per-IP and per-action rate limiting; request size limits.
• SSRF protection on outbound fetches; server-side input validation.
• Containers run as a non-root user; secrets are kept out of source control.

Access, logging & resilience

Least-privilege access, audit logging (including a tamper-evident approval chain), and database backups. We separate tenant data per account.

Privacy by design

In-app tools let you export or erase a person's data (DSAR), manage consent, and control retention — see our Privacy Policy and DPA.

Responsible disclosure

Found a vulnerability? Please email [email protected] with details and allow us reasonable time to remediate. We appreciate good-faith research and will not pursue researchers who act responsibly.

On our roadmap

Multi-factor authentication, regional data residency, and independent attestations (SOC 2 / ISO 27001) are in progress.