Security at CXODash
CXODash handles your organisation’s spend, receipts and finance records. Protecting that data is built into how we design, build and operate the platform — here is exactly what we do.
1 Safeguards we have in place
Encryption in transit
All traffic to the website and the product application is served over HTTPS/TLS. Credentials and data move over encrypted connections.
Strong authentication
Passwords are stored only as a salted, memory-hard one-way hash (argon2) — never in plain text. Sign-in OTPs are random, stored hashed, short-lived and single-use.
Opaque, short-lived sessions
Sessions use high-entropy opaque tokens kept server-side, with limited lifetimes. We do not roll our own cryptographic token formats.
Rate limiting & abuse controls
Authentication and sensitive endpoints are rate-limited per IP to blunt brute-force, credential-stuffing and enumeration attempts.
Strict tenant isolation
Every organisation’s data is segregated and isolation is enforced at the database layer with PostgreSQL Row-Level Security, so one tenant can never read another’s records.
Least-privilege access
The application runs against a non-superuser database role, so isolation rules always apply. Internal access to production is limited to what is necessary to operate the Services.
Full audit trail
Sensitive actions are recorded with who did what and when, giving you an export-ready, tamper-evident history for accountability and audits.
India-hosted infrastructure
Application, database and document storage run on managed AWS services in AWS Asia Pacific (Mumbai) — ap-south-1, India, keeping personal data within India.
Managed durability & backups
Customer data sits in managed AWS databases and object storage, which provide durable storage and automated backups to support recovery.
Secure development
We use offline-verified database queries, dependency vulnerability scanning (cargo audit / npm audit) and periodic self-audits against our internal security rulebook as part of our build process.
2 Privacy & DPDP alignment
Our practices are built to align with India’s Digital Personal Data Protection Act, 2023: we collect only what we need, are transparent about how we use it, keep personal data in India, support Data Principal rights (access, correction, erasure, grievance redressal and nomination), and maintain a named grievance contact. Full detail — including the personal data we process and how to exercise your rights — is in our Privacy Policy.
4 Certifications & honest posture
We do not yet hold formal third-party certifications such as ISO/IEC 27001 or SOC 2. The controls described above are genuinely in place, and our practices are designed around the principles of those frameworks and the DPDP Act. As we scale we intend to pursue formal, independent certification — and we will state it here, accurately, only once achieved.
5 Reporting a vulnerability
If you believe you have found a security vulnerability or have a security concern, please tell us responsibly at admin@cxodash.in. We appreciate disclosures made in good faith, will investigate promptly, and ask that you avoid accessing or modifying other users’ data while testing. In the event of a personal-data breach, we will notify affected parties and the Data Protection Board of India as required by law.