Security
Access control and accountability, by design
Security here means server-enforced permissions, a complete audit trail, and validation at every entry point — not a marketing checklist.
Role-based access control
- Custom roles are built from 36 granular permissions covering every module.
- Permissions are enforced on the server for every API request, not just hidden in the interface.
- A user only sees and can act on what their assigned role allows.
Audit logs
- Every create, update and delete is recorded with the user, the action and a timestamp.
- Changes capture a before/after snapshot so you can see exactly what changed.
Authentication
- Sessions are JWT-based.
- Passwords are hashed with bcrypt, never stored in plain text.
- Login attempts are rate-limited.
Input validation
- Every API endpoint validates its request body and query parameters with Zod before any database write.
File upload validation
- Uploaded files are checked against an extension allowlist.
- File content is sniffed by its magic bytes, so a renamed file cannot pass as a different type.
API security
- Helmet sets standard security headers on every response.
- CORS restricts which origins can call the API.
- Error responses omit stack traces in production.
What we don't claim
We do not hold ISO or SOC certifications, and we make no uptime guarantee. The measures above describe how the application is built, not a compliance attestation. If your organization needs a specific certification or SLA, talk to us before you rely on this page for a compliance decision.
Ready to take control of your business assets?
Request a demo and we will reply from techdino.in, or write to us directly.
info@techdino.in