Security Overview

1. Account & authentication security

• Password hashing — Passwords are never stored in plain text. They are hashed using industry-standard bcrypt with high salt rounds before persistence.
• HttpOnly session tokens — Sessions are managed using secure, short-lived, httpOnly JWT cookies that client-side JavaScript cannot read, mitigating Cross-Site Scripting (XSS) risks.
• Refresh token rotation — Extended sessions use rotating refresh tokens so you remain signed in securely without ever sending plain credentials.
• Google OAuth 2.0— Users can authenticate via Google, leveraging Google’s enterprise-grade identity security and two-step verification.
• Rate limiting & brute-force protection — Sensitive endpoints (sign-in, OTP verification, password resets) are protected by rate limiters to block automated abuse.

2. Data encryption in transit & at rest

• TLS 1.3 encryption — All network communication between user browsers, mobile devices, and KraftNex servers is encrypted using TLS 1.3 / HTTPS.
• HSTS enforcement — HTTP Strict Transport Security (HSTS) headers are enforced across all domains to prevent protocol downgrade attacks and cookie interception.
• Storage encryption — Room photos, design renders, blueprints, and uploaded media are stored in encrypted cloud object storage (Cloudflare R2 / AWS S3) using AES-256.
• Encrypted databases — Production database clusters utilize encrypted storage volumes at rest and require SSL-secured connections with IP restriction.

3. Payment & transaction security

• PCI-DSS Level 1 compliance — All payments, service deposits, and subscriptions are processed through Cashfree Payments inside a certified PCI-DSS Level 1 secure checkout environment.
• Zero plain card storage — KraftNex never receives, processes, or stores full card numbers, CVVs, or bank net-banking passwords on our servers.
• RBI tokenization & 3D Secure — All domestic card transactions comply with RBI card-on-file tokenization mandates and require mandatory two-factor authentication (OTP / 3DS).
• Milestone-based protection — Project funds are held in secure milestone escrows and only disbursed to professionals after homeowner milestone sign-off.

4. Infrastructure & application resilience

• DDoS & WAF defense — Cloudflare Enterprise edge infrastructure filters malicious traffic, bot attacks, and Distributed Denial of Service (DDoS) threats.
• Hardened browser headers — Strict Content Security Policy (CSP), Cross-Origin Resource Sharing (CORS), and defense headers prevent clickjacking and unauthorized data access.
• Environment segregation — Production, staging, and development environments are completely segregated, with distinct access credentials and isolated data stores.
• Role-based access control (RBAC) — Every API request validates authenticated user identity and specific role permissions before processing.

5. Professional & technician verification

• Professional vetting — Interior designers, architects, and real estate partners undergo identity verification and portfolio review prior to platform publication.
• KN-Certified technician KYC — Home-service technicians complete government ID (Aadhaar), selfie verification, and address validation before accepting service bookings.
• Workspace data isolation — Partner portals and dashboards restrict access strictly to project data and client briefs relevant to active engagements.

6. Data privacy & user control

• Content ownership — You retain full ownership of your uploaded photos and briefs; they are processed solely to deliver AI redesigns and requested services.
• Granular consent — Users can review and adjust cookie and analytics preferences at any time via the Cookie Settings panel.
• Self-service account deletion — Users can initiate permanent account and data deletion directly from their profile or the footer link, adhering to applicable privacy regulations.

7. Operational security & monitoring

• Least-privilege access — Internal access to databases and production environments is restricted to authorized engineers through multi-factor authentication and VPNs.
• Audit logging — Critical system actions, permission modifications, and authentication events are logged for security audits and forensic analysis.
• Dependency audits — Automated vulnerability scans and dependency checks run continuously to identify and remediate package vulnerabilities proactively.

8. Responsible vulnerability disclosure

We welcome reports from security researchers and the community to keep KraftNex and our users secure. If you believe you have found a vulnerability:

• Email us privately at security@kraftnex.net with detailed steps to reproduce the issue.
• Please do not access, alter, or destroy data belonging to other accounts, and avoid interrupting service availability.
• Allow our engineering team reasonable time to investigate and remediate the issue before any public disclosure.
• We commit to acknowledging valid security reports promptly, providing status updates, and not pursuing legal action against researchers acting in good faith.