Information Security Policy

1. Security Architecture & Philosophy

Staff Mitr operates on zero-trust and defense-in-depth principles to protect biometric facial templates, banking details, and payroll data from unauthorized access, cross-tenant leakage, and cyber threats.

2. Strict Multi-Tenant Data Isolation

Every database query, API endpoint, and cache lookup is strictly constrained to the authenticated tenant's organization_id. Cross-tenant request spoofing (e.g. manipulating X-Organization-ID or employee IDs) is blocked by server-side query filtering and returns HTTP 403 Forbidden.

3. Biometric & Cryptographic Safeguards

• At-Rest Encryption: 128D/512D facial feature vectors are encrypted using EncryptedJSONField with AES-128-CBC and HMAC-SHA256 (Fernet specification). Runtime assertion blocks application boot if default or weak keys are detected.
• In-Transit Encryption: All communications between kiosks, mobile apps, and servers are enforced via TLS 1.3.
• Private Media Gate: Payslips, Aadhaar/PAN scans, and medical certificates are shielded by secure_media_gate, an internal reverse proxy that validates active session credentials and tenant authorization before releasing files.

4. Authentication & Anti-Brute-Force Controls

• Login Rate Limiting: Enforces a maximum of 5 failed attempts per minute per IP/username. On the 6th attempt, access is blocked with HTTP 429 Too Many Requests and a 300-second lockout cooldown.
• Single Active Mobile Session: Mobile logins enforce hardware binding. If an employee logs in on a new device, previous tokens are superseded immediately ("Phone B kicks out Phone A").
• Role-Based Access Control (RBAC): Granular permissions (VIEW, CREATE, EDIT, DELETE, APPROVE) with branch/department data scoping and strict anti-self-approval blocks on leaves, reimbursements, and loans.

5. CERT-In 6-Hour Incident Notification Compliance

In compliance with the CERT-In Directions (April 2022) and Section 8(6) of the DPDP Act, any confirmed cybersecurity incident or unauthorized database access is escalated and formally reported to CERT-In (incident@cert-in.org.in) within 6 hours of detection. Impacted customer organizations are notified within 24 hours.

6. Vulnerability Disclosure & Safe Harbor

If you discover a security vulnerability, report it to security@staffmitr.in. Provide reproduction steps and allow 30 days for remediation. Staff Mitr will not take legal action against security researchers acting in good faith under these guidelines.