Security

Access control lives in the database, not in the application. Every table in every system we build has row-level security, so a bug in a web page still cannot return one client's records to another. This is the difference between a system that is secure and a system that is currently behaving.

Writes go through reviewed database procedures rather than direct table access, which means the rules about who may change what are enforced in one place and cannot be bypassed by a new screen someone adds later.

• Passwords are stored as bcrypt hashes. Nobody at Relicsoft can read or recover a password — resets issue a new one.
• Accounts created by us start on a single-use random password and cannot do anything until the holder replaces it.
• Sign-in attempts are rate-limited, and sign-ins are logged with time, IP, region, device and operating system.
• Administrative access to production is limited to the proprietor and protected by two-factor authentication.

• HTTPS everywhere, with HSTS. There is no unencrypted path to anything we run.
• Data encrypted at rest by the platform, and in transit end to end.
• Databases in the Mumbai region — data about Indian users stays in India by default.
• Daily automated backups with a 30-day rolling window, and restores tested rather than assumed.
• Secrets held in the hosting platform's encrypted store. No credential is ever committed to a repository.
• Content Security Policy, frame denial and MIME-sniffing protection on every response.

We are not ISO 27001 or SOC 2 certified. We are a small firm and those certifications cost more than they would currently tell you. What we will do is answer any security questionnaire honestly, walk your team through the architecture, and let you audit what we have built.

We would rather lose a deal than pass an audit by overstating something.

Email admin@relicsoft.in with enough detail to reproduce it. We will acknowledge within 2 business days and keep you updated until it is fixed.

If you report a genuine finding in good faith, give us reasonable time to fix it, and do not access, modify or destroy other people's data in the process, we will not pursue any legal action against you and we will credit you if you want the credit. We do not currently pay bounties — we will say so plainly rather than leave you hoping.