Security.

We treat security as a precondition, not a feature. Below is what we do today.

Authentication

• Passwords hashed with scrypt — we never see plaintext.
• HttpOnly, Secure, SameSite=lax session cookies signed with HMAC-SHA256.
• Sessions expire after 30 days of inactivity.
• Brute-force protection on login (rate limited).

Transport

• TLS 1.2+ enforced on every endpoint via Traefik.
• HSTS preload-eligible.
• Strict CSP on admin and customer dashboards.

Data

• Postgres on encrypted volumes, daily off-host backups, monthly restore drills.
• No card data on our servers — payments delegated entirely to Razorpay.
• Audit log of admin actions on customer accounts, retained 12 months.

Reporting issues

Found a vulnerability? Please email security@sepnexus.com. We'll acknowledge within 24 hours.

Last updated: 2026-05-10.