Security

ECN People runs on established cloud providers: application servers on Render, the database on MongoDB Atlas, and uploaded files such as photos and documents on Amazon Web Services. Some of these may store data outside India; the Data Processing Agreement lists each provider and its location.

• All traffic to the web console, the mobile app and the API is encrypted with TLS 1.2 or later; plain HTTP is redirected.
• Our database and file-storage providers encrypt data at rest.
• Passwords are never stored — only a salted, slow hash of them.

• Every company's data is separated by company, and every request is checked against the signed-in user's company and role.
• Roles and permissions decide who sees salaries, bank details and documents; sensitive changes such as a bank-account update go through maker-checker approval.
• Sessions can be signed out remotely, and signing out of the mobile app removes its notification registration.
• An audit log, visible to the company's administrators, of who changed what and when.
• Our own staff reach production only through named, multi-factor-protected accounts, and that access is logged.

• Input validation on every endpoint, rate limits on sign-in and public forms, and HTTP-only cookies for sessions.
• Dependencies are monitored for known vulnerabilities and patched.
• Changes are reviewed and tested before they are released.

Databases are backed up regularly and restores are tested in drills. The service is monitored for errors and downtime.

If a security incident affects your data, we will tell your administrators within 24 hours of becoming aware of it, as set out in the Data Processing Agreement, and report it to CERT-In within six hours where the CERT-In Directions require.

If you believe you have found a security weakness, email info@easyconnectnetwork.com with the details and steps to reproduce. Please do not access other customers' data, degrade the service or publish the issue before we have fixed it. We will acknowledge your report within two working days and keep you updated; we will not take legal action against good-faith research that follows these rules.