Security
Security is foundational, not optional. Built with industry best practices from day one.
🔐 Encryption
- In Transit: TLS 1.3 for all connections (HTTPS only)
- At Rest: AES-256 database encryption
- Passwords: bcrypt with 12 rounds (never plaintext)
- Access Tokens: Stored in an access-restricted database, encrypted at rest
🛡️ Infrastructure
- Hosted on Google Cloud Platform, Mumbai (India). The underlying cloud infrastructure is SOC 2 / ISO 27001 certified by Google Cloud; ViralDM itself has not completed a SOC 2 or ISO 27001 audit.
- Self-managed PostgreSQL (encrypted at rest, automated daily backups)
- Cloudflare DDoS protection & WAF
- Automated off-site encrypted database backups with restore procedure
🔑 Authentication
- Bcrypt password hashing
- Session-based authentication with secure cookies
- OAuth 2.0 for Google, GitHub
- Token expiry & automatic refresh
- Rate limiting on login attempts
🔍 Monitoring
- 24/7 uptime monitoring
- Real-time error tracking
- Anomaly detection on API usage
- Audit logs for admin actions
🚨 Incident Response
- Documented response playbook
- Breach notification within 72 hours
- Post-incident reports for transparency
- Continuous improvement after each incident
👨💻 Code Security
- Input sanitization on all endpoints
- SQL injection protection (Prisma ORM)
- XSS protection (Helmet middleware)
- CSRF tokens on state-changing requests
- Dependency vulnerability scanning
🌐 API Security
- API keys hashed in database
- Rate limiting per key/IP
- Webhook signature verification
- Scope-limited permissions
🔒 Data Privacy
- Minimal data collection
- Data isolation between tenants
- Right to deletion honored within 30 days
- No selling of user data, ever
🐛 Vulnerability Disclosure
Found a security issue? Email [email protected] with:
- Description of vulnerability
- Steps to reproduce
- Proof of concept (if safe)
- Your contact info
We commit to:
- Acknowledge within 48 hours
- Provide status updates every 7 days
- Public credit if you wish (after fix)
- Bug bounty for critical findings
📜 Compliance
- Indian DPDPA 2023 compliant
- GDPR ready (EU users)
- CCPA compliant (California users)
- Meta Platform Policy compliant
- YouTube API Terms compliant
Contact
Security questions: [email protected]