Security Policy

Security is foundational to how आरंभ Tours & Travels operates. We process sensitive personal data including customer identities, driving licences, and payment information — and we take our responsibility to protect this data seriously.

This document describes the technical and organisational security measures we have implemented to protect our systems and your data.

• JSON Web Tokens (JWT) — Sessions use JWTs with a 24-hour expiry. Tokens are verified against a cryptographic secret on every request.
• Token revocation — Changing your password immediately invalidates all existing sessions across all devices via a `tokenVersion` mechanism.
• Login rate limiting — Maximum 5 login attempts per 15 minutes per IP + email combination. Breaches are logged to our security audit trail.
• Account registration limiting — Maximum 3 registrations per hour per IP to prevent mass account creation.
• Email verification — New accounts require email verification using a cryptographically random 32-byte token with 24-hour expiry.
• Password reset tokens — Single-use tokens that expire after 15 minutes. Enumeration-resistant (same response whether email exists or not).

We process payments through Razorpay, a PCI-DSS Level 1 certified payment gateway. We do not store full card numbers, CVVs, or banking credentials on our servers.

• HMAC verification — All Razorpay payment callbacks are verified using constant-time HMAC-SHA256 signature comparison (`crypto.timingSafeEqual`) to prevent forgery.
• No card data stored — Card details are handled entirely by Razorpay's PCI-DSS infrastructure.
• UTR validation — Manual bank transfer references (UTR numbers) are stored encrypted and validated by our team before confirming bookings.

• Hosting — Backend hosted on Render.com; database on MongoDB Atlas — both with private network access controls.
• Environment secrets — All API keys, database credentials, and JWT secrets are stored as environment variables — never committed to version control.
• Security headers — Every HTTP response includes: `X-Content-Type-Options: nosniff`, `X-Frame-Options: SAMEORIGIN`, `X-XSS-Protection`, `Strict-Transport-Security`, and `Referrer-Policy`.
• Bot detection — Automated scanner and known attack tools (sqlmap, nikto, masscan, etc.) are blocked at the application layer.
• Suspicious traffic logging — Path traversal attempts, SQL injection probes, and anomalous request patterns are logged and flagged to our audit trail.

• Role-based access — Admin users are assigned `superadmin` or `viewer` roles. Destructive operations (delete, status changes) are restricted to superadmin only.
• Ownership verification (IDOR prevention) — Customers can only access their own booking data. Cross-account data access attempts are blocked with 403 Forbidden and logged.
• Database access — MongoDB Atlas is not exposed to the public internet. Access is restricted to application server IPs only.

In the event of a confirmed security incident involving customer data:

1. We will isolate affected systems within 4 hours of detection.
2. Affected customers will be notified within 72 hours of confirming a breach.
3. Notification will include: what data was affected, what we are doing, and steps you should take.
4. Regulatory authorities will be notified as required by applicable law.
5. A post-incident report will be published to affected customers within 30 days.

We welcome responsible security research. If you discover a vulnerability in our platform, please report it to us before public disclosure. See our Responsible Disclosure Policy for full details, including scope, safe harbor, and response time commitments.