Security

How we protect your data and maintain security

Last Updated: January 1, 2025

Security is fundamental to everything we do at ManagerBook. We implement industry best practices and continuously monitor and improve our security posture to protect your data.

Security Overview

→ Data Encryption→ Infrastructure Security→ Access Controls→ Application Security→ Compliance & Certifications→ Incident Response

1. Data Encryption

1.1 Encryption in Transit

  • TLS 1.3: All data transmitted between your browser and our servers is encrypted using industry-standard TLS 1.3 protocol
  • HTTPS Only: We enforce HTTPS across all connections
  • Strong Cipher Suites: We use only strong, modern cipher suites and disable weak encryption algorithms
  • Certificate Pinning: HSTS (HTTP Strict Transport Security) is enabled to prevent downgrade attacks

1.2 Encryption at Rest

  • Database Encryption: All database storage is encrypted using AES-256 encryption
  • File Storage: Uploaded files are encrypted at rest in our secure storage systems
  • Backup Encryption: All backups are encrypted using the same strong encryption standards
  • Key Management: Encryption keys are managed securely and rotated regularly

1.3 Password Security

  • Secure Hashing: Passwords are hashed using bcrypt with appropriate salt rounds
  • Never Stored in Plain Text: We never store or log passwords in plain text
  • Password Requirements: Minimum password strength requirements are enforced
  • Two-Factor Authentication: Optional 2FA support for enhanced account security

2. Infrastructure Security

2.1 Cloud Infrastructure

  • Trusted Providers: Hosted on enterprise-grade cloud infrastructure (Vercel, AWS/GCP)
  • Geographic Redundancy: Data is replicated across multiple availability zones
  • DDoS Protection: Built-in DDoS mitigation and protection
  • Network Isolation: Services are deployed in isolated network environments

2.2 System Monitoring

  • 24/7 Monitoring: Continuous monitoring of system health and security
  • Automated Alerts: Real-time alerts for security events and anomalies
  • Log Analysis: Comprehensive logging and analysis of system activities
  • Intrusion Detection: Automated intrusion detection systems (IDS)

2.3 Regular Updates

  • Security Patches: Regular application of security patches and updates
  • Dependency Management: Continuous monitoring and updating of dependencies
  • Vulnerability Scanning: Regular automated vulnerability scans

3. Access Controls

3.1 Authentication

  • Multi-Factor Authentication: Support for 2FA/MFA
  • SSO Support: Integration with enterprise SSO providers (SAML, OAuth)
  • Session Management: Secure session handling with automatic timeout
  • Account Lockout: Automatic lockout after failed login attempts

3.2 Authorization

  • Role-Based Access Control (RBAC): Granular permissions based on user roles
  • Principle of Least Privilege: Users have minimum necessary permissions
  • Multi-Tenancy: Complete data isolation between organizations
  • Audit Trails: All access and actions are logged

3.3 Internal Access

  • Limited Access: Strict internal access controls to production systems
  • Need-to-Know Basis: Employees only access data when necessary for support
  • Access Logging: All internal access is logged and monitored
  • Background Checks: Team members undergo background verification

4. Application Security

4.1 Secure Development

  • Secure Coding Practices: OWASP Top 10 and secure coding standards
  • Code Reviews: All code is reviewed before deployment
  • Static Analysis: Automated security analysis of code
  • Dependency Scanning: Regular scanning for vulnerable dependencies

4.2 Protection Against Common Attacks

  • SQL Injection: Parameterized queries and ORM usage
  • XSS (Cross-Site Scripting): Input sanitization and output encoding
  • CSRF (Cross-Site Request Forgery): CSRF tokens for all state-changing operations
  • Clickjacking: X-Frame-Options and CSP headers
  • Rate Limiting: Protection against brute force and DDoS attacks

4.3 API Security

  • Authentication Required: All API endpoints require authentication
  • Rate Limiting: API rate limits to prevent abuse
  • Input Validation: Strict validation of all API inputs
  • Secure Tokens: JWT tokens with appropriate expiration

5. Data Management & Privacy

5.1 Data Isolation

  • Multi-Tenant Architecture: Complete logical separation between organizations
  • Database-Level Isolation: Tenant-specific data access controls
  • No Cross-Tenant Access: Users can only access their organization's data

5.2 Data Backup

  • Automated Backups: Daily automated backups of all data
  • Encrypted Backups: All backups are encrypted
  • Retention Policy: Backups retained for 30 days minimum
  • Disaster Recovery: Documented disaster recovery procedures

5.3 Data Deletion

  • Secure Deletion: Secure deletion procedures for account termination
  • Retention Period: Data retained for 90 days after account deletion
  • Right to Deletion: Users can request immediate data deletion

6. Compliance & Certifications

6.1 Regulatory Compliance

  • GDPR: Compliant with EU General Data Protection Regulation
  • CCPA: Compliant with California Consumer Privacy Act
  • Data Privacy: Adherence to international data privacy standards

6.2 Industry Standards

We follow industry best practices and standards, including:

  • OWASP (Open Web Application Security Project) guidelines
  • CIS (Center for Internet Security) benchmarks
  • NIST (National Institute of Standards and Technology) frameworks

Note: We are committed to achieving SOC 2 Type II and ISO 27001 certifications. Current compliance status and certifications can be verified upon request.

7. Incident Response

7.1 Security Incident Management

  • 24/7 Monitoring: Continuous security monitoring and alerting
  • Incident Response Plan: Documented procedures for security incidents
  • Rapid Response Team: Dedicated team for security incidents
  • Post-Incident Analysis: Thorough analysis and remediation after incidents

7.2 Breach Notification

  • Timely Notification: Users will be notified promptly of any data breaches
  • Regulatory Compliance: Notifications comply with applicable laws (GDPR, CCPA, etc.)
  • Transparency: Clear communication about the nature and impact of incidents

7.3 Continuous Improvement

We continuously review and improve our security practices based on:

  • Lessons learned from incidents
  • Emerging threats and vulnerabilities
  • Industry best practices
  • Customer feedback

8. Third-Party Security

We carefully vet all third-party service providers and ensure they meet our security standards:

  • Due Diligence: Security assessment of all vendors
  • Compliance Verification: Vendors must meet relevant compliance standards
  • Data Processing Agreements: Formal agreements with all data processors
  • Regular Reviews: Periodic review of vendor security practices
  • Limited Access: Third parties have minimum necessary access

Key Third-Party Services:

  • Hosting: Vercel (enterprise-grade infrastructure)
  • Database: Neon/Supabase (encrypted PostgreSQL)
  • Authentication: NextAuth (industry-standard auth)
  • AI Services: OpenAI (with data retention controls)

9. Employee Security Training

Our team is our first line of defense:

  • Security Training: Regular security awareness training for all employees
  • Secure Development Training: Specialized training for development team
  • Access Reviews: Periodic review of employee access rights
  • Confidentiality Agreements: All employees sign NDAs
  • Offboarding Process: Immediate revocation of access upon termination

10. Security Best Practices for Users

You play an important role in keeping your account secure:

Do This

  • ✓ Use strong, unique passwords
  • ✓ Enable two-factor authentication
  • ✓ Keep your software updated
  • ✓ Review access logs regularly
  • ✓ Report suspicious activity
  • ✓ Use secure networks

Avoid This

  • ✗ Share your password
  • ✗ Use public Wi-Fi without VPN
  • ✗ Click suspicious links
  • ✗ Ignore security warnings
  • ✗ Use same password everywhere
  • ✗ Leave accounts logged in

11. Responsible Disclosure

We welcome reports from security researchers:

Report a Security Vulnerability

If you discover a security vulnerability, please report it responsibly:

  • Email us at: security@managerbook.in
  • Provide detailed information about the vulnerability
  • Give us reasonable time to address the issue
  • Do not exploit the vulnerability beyond verification

We commit to acknowledging reports within 48 hours and keeping you informed of our progress.

12. Security Questions?

If you have questions about our security practices or need to report a security concern:

ManagerBook Security Team

Security Issues: security@managerbook.in

General Inquiries: support@managerbook.in

Website: www.managerbook.in

Security Documentation: For detailed security documentation, compliance certificates, or to discuss enterprise security requirements, please contact our security team.

← Back to Home