Security & Trust

Security is foundational to CoreLayerEngine. This page summarises how Ektasi Technology (OPC) Private Limited protects your data. (It describes our practices and is not a warranty; see our Disclaimer.)

Data protection

• Encryption in transit: TLS with HSTS across the platform.
• Encryption at rest for secrets: OAuth access and refresh tokens, two-factor secrets and webhook secrets are sealed with AES-256-GCM envelope encryption before they are written, each bound to its own record so a copied ciphertext cannot be reused elsewhere. Keys rotate without a migration, and production refuses to start without one.
• Encrypted backups: 7 daily / 4 weekly / 12 monthly, encrypted, stored in the same region as the data, with an automated job that restores the newest backup into a scratch database to prove it works — a failed or stale check pages the on-call engineer.
• Passwords: hashed with scrypt and a per-user salt — never stored in plain text; verified in constant time.
• Signed sessions & CSRF protection on every state-changing request.

Payments

All card payments are processed on our providers' own hosted checkout pages (Stripe, Razorpay, Cashfree, Paddle, Lemon Squeezy or PayPal). Card numbers never touch our servers, keeping us to the lowest PCI DSS scope (SAQ A). Webhooks are signature-verified.

Application security

• Strict Content-Security-Policy, X-Content-Type-Options, frame-deny, and other hardened headers.
• Upload validation by true file type (magic bytes) — executable/SVG/script uploads are rejected.
• Per-IP and per-action rate limiting; request size limits.
• SSRF protection on outbound fetches; server-side input validation.
• Containers run as a non-root user; secrets are kept out of source control.

Access, logging & resilience

Least-privilege access and two-factor authentication (TOTP), which can be enforced organisation-wide. API keys act as a distinct machine principal and can never stand in as the second human approver under the two-person rule. Governance actions are written to a hash-chained, tamper-evident audit trail you can export as CSV or PDF, with the chain head printed on the export. Tenant data is separated per account, and where regional sharding is enabled a request for a region a node does not hold is refused outright rather than served from another region's database.

Privacy by design

In-app tools let you export or erase a person's data (DSAR) from Profile → Privacy & data, manage consent per channel, and set retention windows. Deleting a workspace erases it in every region we can reach and leaves only a tombstone containing no personal data. Data is stored in India. That is the only region we operate — there is no European Union, Singapore or United States shard, and no way to move a workspace to one. See our Privacy Policy, Sub-processors and DPA.

Responsible disclosure

Found a vulnerability? Please email innovations@ektasi.io (the address published in our security.txt) with details and reproduction steps. We acknowledge good-faith reports within three business days, and will not pursue researchers who act responsibly. Our targets: critical issues mitigated within 24 hours and fixed within 7 days; high within 14 days; medium within 60 days.