Security & Trust

How we protect your data

ProdGem is built with security and privacy by design. Here is exactly what we do.

Compliance frameworks

GDPREU privacy

DPDP ActIndia 2023

PCI SAQ-APayments

SOC 2In progress

ISO 27001In progress

Security controls

Encryption everywhere

Passwords hashed with bcrypt (cost factor 12) — never stored or recoverable
All traffic over TLS — HTTPS enforced with HSTS and strict Content Security Policy
Auth tokens in httpOnly, Secure, SameSite=Strict cookies — no localStorage exposure
Download files as AES-256 password-protected ZIPs delivered via short-lived signed URLs

Payment security (PCI SAQ-A)

Card numbers never transit or touch our servers — Razorpay tokenizes in its own hosted interface
PCI DSS SAQ-A posture: minimal scope confirmed by design
We store only payment reference IDs and order amounts — no PAN, no CVV, no expiry
Sub-processor: Razorpay (PCI DSS Level 1)

Access control & RBAC

Role-based access: SUPER_ADMIN / ADMIN / USER with fine-grained permissions
Every API endpoint guarded by JwtAuthGuard + RolesGuard + PermissionsGuard
Admin panel requires ADMIN or SUPER_ADMIN role; critical actions require SUPER_ADMIN
Optional SMS multi-factor authentication via Twilio

Infrastructure & audit

Tamper-evident audit log with HMAC-SHA256 integrity hash on every entry
All changes via pull request — no direct pushes to master; CI security gates on every PR
CI pipeline: Gitleaks (secret scan) + Semgrep (SAST) + OSV-Scanner (dependency CVEs)
Secrets managed via environment variables — never committed to git

Privacy & data protection

GDPR (EU) + India DPDP Act 2023 compliant
Cookie consent banner with granular categories (essential / analytics / marketing)
Global Privacy Control (GPC) browser signal honoured automatically
Data Subject Request (DSR) workflow: access, erasure, rectification, portability
Automated nightly deletion cron jobs enforce retention schedules
Records of Processing Activities (RoPA) maintained per GDPR Art. 30

Incident response

Documented incident response runbook with Sev1–4 taxonomy
GDPR 72-hour breach notification procedure
DPDP breach notification to Data Protection Board per Rules (Nov 2025)
Sentry error monitoring with PII scrubbed before transmission

Sub-processors

We share personal data only with the following service providers, each bound by a Data Processing Agreement.

Provider	Role	Country	Certifications
Razorpay	Payment processing, including international cards	IN	PCI DSS Level 1, SOC 2
Cloudflare	CDN, DDoS protection, R2 file storage	US/Global	SOC 2, ISO 27001
Resend	Transactional email delivery	US	SOC 2
Sentry	Error monitoring (PII scrubbed before send)	US	SOC 2
Twilio	SMS MFA (optional second factor)	US	SOC 2, ISO 27001

Responsible disclosure

If you discover a security vulnerability, please report it to us privately before public disclosure. We will acknowledge within 3 business days and resolve critical issues within 30 days.

[email protected]