Legal Document Template · Status: Needs Final Lawyer Review
This document is a standardized B2B SaaS legal framework prepared for BaseraBook compliant with the Digital Personal Data Protection (DPDP) Act 2023 (India) and the General Data Protection Regulation (GDPR). It must be reviewed and customized by your designated legal counsel prior to commercial enforcement.
BaseraBook Security Architecture
Last Updated: September 28, 2026 · SOC 2 & ISO 27001 Aligned Controls
1. Multi-Tenant Cryptographic Isolation
BaseraBook implements defense-in-depth security principles. Multi-tenant customer data is isolated at the database engine level utilizing PostgreSQL Row Level Security (RLS) policies. Every incoming query is bound to the verified cryptographic JWT identity of the authenticated user, preventing cross-tenant data leakage even in the event of client-side code compromise.
2. Core Security Controls
Encryption In-Transit & At-Rest
All data in transit is encrypted using modern TLS 1.3 with HSTS preloading. Database volumes and automated backup snapshots are encrypted at rest using AES-256.
Privileged Role Defense
Super Admin privileges cannot be assigned via public signups or client mutations. Role escalation is blocked via database triggers, and all administrative actions are immutably logged to platform audit logs.
Edge Abuse & Rate Limiting
Next.js Edge Middleware enforces token-bucket rate limiting on authentication and API routes, preventing automated credential stuffing, brute-force attacks, and scraping.
Automated Redundancy
Daily automated database snapshots and point-in-time recovery (PITR) safeguards customer business records against regional cloud outages and accidental disasters.
3. Incident Response & Breach Notification
BaseraBook maintains a documented incident response runbook. In the unlikely event of a verified data breach impacting personal resident or property records, affected customers and relevant supervisory authorities will be formally notified within 72 hours of verification pursuant to GDPR and Section 8(6) of the India DPDP Act 2023.
4. Responsible Vulnerability Disclosure
If you discover a security vulnerability or suspect an incident, please report it immediately to our security response team at: baserabook.team@gmail.com. We investigate all actionable reports promptly.