1. Our Security Model
We adhere to a zero-trust, defense-in-depth security paradigm. Every incoming request is cryptographically validated, every ledger partition is logically and cryptographically isolated, and all service secrets follow strict least-privilege principles.
Passkey-First (FIDO2)
Hardware-bound biometric credentials prevent credential phishing, replay attacks, and credential-stuffing breaches.
Indian Datacenter Residency
Direct control over infrastructure in high-tier Indian facilities with audited physical and perimeter security.
2. Cryptographic Architecture
We do not invent proprietary crypto algorithms; we rely on battle-tested, peer-reviewed international standards:
- In-Transit Security: Compulsory TLS 1.3 with Perfect Forward Secrecy (ECDHE), strict HSTS (max-age 63072000), and automated ACME certificate rotation.
- At-Rest Encryption: Database records, snapshots, and persistent block volumes are encrypted using AES-256-GCM.
- Password & Secret Hashing: Argon2id (memory-hardened key derivation) with distinct cryptographic salts for any fallback credentials.
- Token Signing: Ed25519 asymmetric cryptographic signatures for ephemeral OIDC session tokens.
3. Authentication & Identity Guardrails
Sweyam Auth acts as the gatekeeper for our platform:
- Rate limiting with sliding-window token buckets on all authentication and token-exchange endpoints.
- Automatic revocation of all sessions on password/passkey modifications.
- Cryptographically signed, short-lived access tokens combined with secure HTTP-only, SameSite=Strict refresh cookies.
- Protection against CSRF, SSRF, XSS, and clickjacking via strict Content Security Policy (CSP) headers.
4. Infrastructure Hardening & Backups
Our hosting topology incorporates strict separation between public entry points, application microservices, and database layers:
- No database or internal Redis cluster is directly exposed to public IP addresses; all internal communications operate over private virtual overlay networks.
- Automated immutable daily database snapshots encrypted with distinct KMS keys and tested quarterly for disaster recovery.
- Continuous container image vulnerability scanning and automated patch deployment pipelines.
5. Responsible Vulnerability Disclosure
We warmly welcome and appreciate security research from the global developer and ethical hacker community. If you discover a potential vulnerability in any Sweyam service, repository, or API:
Reporting Email: [email protected]
PGP Key Fingerprint: 4A9F 82C1 9DE3 658B 7B12 3F09 E871 5D3A 6366 F101
Response Timeline: Initial acknowledgment within 24 hours; validation and fix assessment within 72 hours.
Please include a reproducible proof-of-concept (POC), steps to reproduce, and the potential impact. Please do not access or modify other users' accounts or attempt denial-of-service tests on production systems.
6. Safe Harbor for Security Researchers
If you conduct vulnerability research in good faith and comply with our disclosure guidelines:
- We will not initiate legal action against you or contact law enforcement regarding your testing activities.
- We will work constructively with you to understand and remediate the issue promptly.
- We will publicly acknowledge your contribution in our Security Hall of Fame (unless you wish to remain anonymous).