Security First

Your data is non-negotiable.

TLS 1.3 in transit. AES-256 at rest. DPDP Act compliant. Here's exactly how we protect your information.

Encryption

All data encrypted in transit (TLS 1.3)
Passwords hashed with bcrypt (12 rounds, salted)
Database connections encrypted
JWT tokens signed with RS256

Authentication

JWT access tokens with 15-minute TTL
Refresh tokens with 7-day TTL, httpOnly cookies
Google OAuth 2.0 login support
Password reset with time-limited tokens
Rate-limited auth endpoints (10/min)

Infrastructure

Hosted on AWS (Mumbai region, ap-south-1)
PostgreSQL 16 with automated backups
Redis for session cache and rate limiting
Docker containers with minimal attack surface
CI/CD with automated security checks

Access Control

Role-based access control (RBAC) for admin features
Subscription-tier gating on all premium endpoints
API rate limiting: 100/min default, 10/min auth, 20/min AI
Admin panel protected by JWT + role verification
CORS restricted to approved origins

DPDP Act Compliance

Compliant with India's Digital Personal Data Protection Act, 2023
Explicit consent collection before data processing
Right to erasure — users can delete their account and all data
Data export — users can download their data from Settings
Privacy policy clearly states data usage and retention

Data Retention

Active accounts: data retained while account is active
Deleted accounts: personal data purged within 30 days
Anonymised analytics data retained for product improvement
Backup data rotated on 30-day cycle
Logs retained for 90 days for security monitoring

Vulnerability Reporting

Found a security issue? We appreciate responsible disclosure. Please email us at security@nexarc.ai with a detailed description of the vulnerability. We aim to respond within 48 hours.