Security
How we protect your data
What is in place today, and nothing more.
In place today
- HTTPS on every DLI address. Certificates are issued by Let's Encrypt and renewed automatically.
- Servers in India: a virtual private server in Mumbai.
- Administrator access by SSH key only. Password login to the server is turned off.
- A firewall that allows only the ports needed. Repeated failed logins from one address are blocked for one hour.
- Sign-in and sign-up codes are stored only as keyed hashes. A code expires after five minutes, works once, and stops working after five wrong attempts.
- Sessions are stored only as hashes, and removed 30 days after they end.
- An audit log of important actions. Each entry is linked to the one before it, and entries cannot be changed or deleted by the application.
- Daily database backups, kept for 14 days on the same server. A restore has been tested.
- The identity check does not take your Aadhaar number.
Not in place yet
- We do not hold a security certification (for example ISO 27001).
- Backups are not yet copied to a second location, away from the server.
- Sign-in codes are not sent yet, because the messaging provider is not confirmed.
Report a security issue
Write to support@dhyanshivindia.in with the details. Please do not test the service in a way that affects other people.