Security at Payvio

• Encryption in transit: all traffic uses TLS; database connections are required to use TLS in production.
• Encryption at rest: data and document storage are encrypted at rest (AES-256).
• Field-level encryption: sensitive identifiers (bank account number, IFSC, PAN, Aadhaar, UAN) and compensation amounts are additionally encrypted at the application layer, so they remain ciphertext even to someone with raw database access.
• Secrets management: application secrets are injected from a platform secret store, never committed to source or baked into images.

• Role-based access control with granular, per-organization permissions.
• Strict multi-tenant isolation — every request is bound to an organization context and data access is scoped so one customer can never reach another's data. This is covered by automated isolation tests.
• Sessions use signed, httpOnly, Secure, SameSite cookies with bcrypt-hashed credentials.
• Least-privilege database and cloud access.

• Strict input validation across all API endpoints.
• Security headers (HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy) and parameterized database access.
• SSRF protection on outbound webhooks (private/reserved address ranges blocked, redirects disabled) and signed, verified inbound webhooks.
• Rate limiting globally, with tighter limits on authentication endpoints.

Security-relevant actions — logins, role changes, payroll approvals, exports, and key management — are recorded in an immutable, append-only audit trail that cannot be modified or deleted through the application. Passwords, tokens, secrets, and card numbers are never written to logs.

If you believe you've found a security vulnerability, please email security@stackmentalist.com. We investigate all good-faith reports and will not pursue legal action against researchers who follow our disclosure policy.