Security Policy
At TiffinManager, we recognize that protecting your operational schedules, driver locations, and customer balances requires rigorous security controls.
1. Data Encryption
A. In Transit: All HTTP connections are encrypted via TLS 1.3. Any data sent from customer portals or merchant dashboards is protected during transmission.
B. At Rest: Databases and file backups are encrypted utilizing AES-256 standards on cloud servers.
2. Access Controls & Authentication
We enforce strict authorization layers (ACL) across our application. Staff accounts created by Merchants are limited to specific permissions (e.g. `kitchen_view`, `route_update`) to prevent unauthorized dashboard exports or profile changes.
3. Hosting and Datacenter Security
TiffinManager code runs on secured cloud instances equipped with firewalls, DDoS mitigation, and automatic vulnerability scanning systems. Physical datacenters maintain SOC 2 compliance.
4. Vulnerability Disclosure
We welcome reports from security researchers. If you identify a security issue in our routing, payment callbacks, or file upload systems, please email us directly at [email protected]. We investigate all valid submissions.
5. Office and Server Audits
Our engineering team at Patna, Bihar, India conducts quarterly code refactoring audits to check for session leaks, database injection vulnerabilities, and server updates.