Security

Overview

Security is foundational to the Prabhix platform. Our multi-tenant architecture, mail subsystem, and billing integrations handle sensitive business data — we design for defence in depth, not checkbox compliance.

Infrastructure

• Production workloads run on AWS EC2 with Docker, fronted by Caddy for automatic TLS (Let's Encrypt).
• PostgreSQL and Redis are not exposed to the public internet in production. Database access is restricted to application containers via private networking.
• Attachments and exports are stored in S3-compatible object storage with signed URLs — never in the database.
• Infrastructure secrets are managed via environment variables and are never committed to source control.

Application security

• Authentication: JWT access tokens (15-minute TTL) with refresh token rotation. Optional SSO/SAML on Enterprise plans.
• Authorization: Fine-grained RBAC with permissions embedded in JWT claims. Declarative enforcement via Spring Security.
• Tenant isolation: Three redundant layers — JWT org claim, request-scoped TenantFilter, Hibernate query filters — plus Postgres row-level security on high-risk tables.
• Input validation: Jakarta Bean Validation on all API DTOs. Parameterized queries via JPA — no raw SQL concatenation.
• Rate limiting: Per-IP and per-organization token buckets in Redis.

Data protection

• Encryption in transit: TLS 1.2+ on all endpoints
• Encryption at rest: AWS EBS and S3 default encryption
• Passwords hashed with bcrypt (or delegated to SSO provider on Enterprise)
• Audit logging: append-only trail for sensitive operations, partitioned and archived to S3 after 90 days

Email security

• SPF, DKIM, and DMARC enforced on customer domains via our mail server
• Rspamd for inbound spam and malware filtering
• Inbound ingestion idempotent on RFC 5322 Message-ID
• Outbound mail via queued outbox — never direct SMTP in request path

Operational practices

• Dependencies scanned in CI; critical patches applied within 72 hours
• Production access limited to authorized engineers with audit logging
• Database migrations tested against staging before production
• Backups: daily Postgres snapshots with tested restore procedures

Incident response

We maintain an incident response procedure covering detection, containment, notification, and post-mortem. Enterprise customers receive notification within 72 hours of confirmed data breaches affecting their organization data, per our DPA.

Report security vulnerabilities to security@prabhixtechnologies.com. We acknowledge reports within 2 business days.

Compliance

We support enterprise compliance requirements through our DPA, audit log exports, and security documentation. Formal SOC 2 certification is on our roadmap for Enterprise customers — contact sales for current status.