Our Security Commitment
Platemetrics is built with security at its core. We follow a defense-in-depth approach combining infrastructure security, application security, and operational security to protect your organization's data.
Infrastructure Security
- Hosted on AWS with data centers in ap-south-1 (Mumbai) region
- VPC isolation with private subnets for all backend services
- WAF (Web Application Firewall) on all public endpoints
- DDoS protection via AWS Shield Standard
- Automated vulnerability scanning on all EC2 and container images
Data Encryption
- All data encrypted in transit via TLS 1.2 / 1.3
- All data encrypted at rest using AES-256 (AWS KMS managed keys)
- Database backups encrypted and retained for 30 days
- Secrets managed via AWS Secrets Manager — never hardcoded
Application Security
- JWT-based authentication with short-lived access tokens and rotating refresh tokens
- Role-based access control (RBAC) — Super User / Sub User model
- bcrypt password hashing (cost factor 12)
- OTP-verified delivery flow with Redis TTL (15-minute expiry)
- CORS policy enforced on all API endpoints
- SQL injection prevention via SQLAlchemy ORM parameterized queries
- Dependency vulnerability scanning via GitHub Dependabot
- CodeQL static analysis on every pull request
Access Control & Audit
- Audit event log captures all admin actions with actor, timestamp, and entity
- Super Admin approval workflow for sensitive changes
- Failed login attempts are rate-limited and logged
- Multi-factor authentication available for Governance Console users
Compliance Posture
- SOC 2 Type II audit in progress (expected Q3 2026)
- GDPR compliant data handling practices
- IT Act 2000 & DPDPA 2023 (India) compliant
Vulnerability Disclosure
Found a security vulnerability? We appreciate responsible disclosure. Please email security@platemetrics.in with full details. We commit to responding within 48 hours and resolving critical issues within 7 days.