Legal

Security & Trust

Last updated:

Security is a non-negotiable at mysphurit. This page lists exactly what we do to protect your data, so your IT / security team can audit us against their checklist.

1. Encryption

  • In transit — TLS 1.2+ on every endpoint, with HSTS enforced in production.
  • At rest — AES-256 at the filesystem + database level.
  • Secrets — third-party API credentials are stored in an encrypted vault; the platform owner rotates them via SuperAdmin.

2. Authentication

  • Password policy: minimum 10 characters, mixed case, digit, symbol. Production enforces HaveIBeenPwned breach check.
  • Two-factor authentication (TOTP) is mandatory for platform SuperAdmins and available to every tenant admin and employee.
  • Login rate limiting — 5 attempts per minute per email + IP, with progressive lockout.
  • Recovery codes issued on 2FA setup; single-use.

3. Session security

  • Session IDs regenerated on login, logout, and any privilege swap (including SuperAdmin impersonation start / stop).
  • CSRF tokens on every state-changing request.
  • Cookies: HttpOnly, SameSite=Strict, and Secure in production.
  • Default session lifetime: 120 minutes, configurable per tenant.

4. Tenant isolation

  • Every tenant-scoped model enforces a BelongsToTenant global scope at the ORM level.
  • All admin routes pass through an EnsureTenantActive middleware that blocks access for suspended or trial-expired tenants.
  • Cross-tenant data access is impossible without a raw SQL override, which only SuperAdmin can issue (and every such action is audit-logged).

5. Audit trail

  • Every login, logout, failed login, lockout, password reset, and registration is recorded.
  • Admin actions inside the platform are logged via Spatie Activity Log.
  • SuperAdmin impersonation writes a dedicated row to impersonation_logs with actor, target, reason, IP, user agent, and the start/stop timestamps.
  • A dedicated security log channel rotates daily (90-day retention) for SIEM ingestion.

6. Infrastructure

  • Hosted on managed infrastructure in the India (Mumbai) region.
  • Daily encrypted backups with 7-day point-in-time recovery.
  • Security headers enforced at every response: CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy.
  • Outbound API traffic rate-limited to protect upstream providers and detect abuse.

7. Payments & PCI

Card payments are processed entirely by Razorpay (PCI-DSS Level 1 certified). We never store card numbers, CVVs, or full card details. We retain only the Razorpay payment id + status + amount.

8. Privacy of optional integrations

  • Google Drive — files stay in your Drive. Our platform only writes / reads the tenant folder you authorise and you can revoke access from Google Account permissions at any time.
  • Meta (Facebook / Instagram) — only the scopes you approve during OAuth consent. We only read lead-related page data, never DMs or personal profiles.
  • WhatsApp / SMS — messages are sent through your chosen provider (MSG91 / Twilio); we never archive PII beyond delivery receipts.

9. Responsible disclosure

Found a security issue? Please report it to support@mysphurit.com with the subject line SECURITY. We commit to:

  • An initial acknowledgement within 48 hours.
  • A triaged response within 5 business days.
  • A public thank-you on this page once the issue is fixed (if you wish).
  • We do not take legal action against good-faith researchers who follow this policy.

10. Compliance posture

  • India's IT Act 2000 + DPDPA 2023 (Digital Personal Data Protection Act).
  • CBIC e-invoice + GSTN schema support (GSTR-1 / GSTR-3B).
  • ISO 27001 roadmap — internal controls mapped; external audit planned FY 26-27.
Questions about this policy? support@mysphurit.com or contact sales.