Security at CXOLens
Last updated 4 July 2026
Companies hand us the identifiers and records behind their statutory compliance — PAN, TAN, GSTIN, director details, payroll data and challans, across every entity. We treat that as sacred. This page describes, in plain terms, the measures we take to protect it. It sits alongside our Privacy Policy and Terms.
All traffic to the Services is served over TLS/HTTPS. Plain-HTTP access is redirected and HSTS is enforced in production.
Secrets such as integration credentials and mail passwords are encrypted at the application layer before they are stored — never kept in plain text.
Passwords are stored only as salted one-way hashes (bcrypt). One-time passcodes for two-factor sign-in are stored hashed and expire within minutes. Sessions use signed, expiring tokens in httpOnly, secure, sameSite cookies, and trusted devices can be revoked.
Every read and write is scoped to the signed-in company and entity. Tenant isolation is enforced in the application on every query and continuously verified by an automated cross-tenant test suite that we run before each release. One company can never see another’s data.
Access is scoped to what each user’s role allows. Administrative surfaces are gated and invisible to unauthorised users — they receive a 404, not a hint that the surface exists.
Authentication, one-time-passcode and other sensitive endpoints are rate-limited, with a temporary lockout after repeated failed sign-ins, to resist brute-force and abuse.
Cross-entity access attempts and blocked writes are recorded to a security-event log, and every filing carries a verification record — who recorded and verified it, and when. Administrators can review both in the audit log.
Infrastructure, database and document storage run on AWS Asia Pacific (Mumbai) — ap-south-1, India. We aim to keep personal data within India.
Server-side validation of input, parameterised database queries (no string-built SQL), security headers, and dependency review as part of our development process.
Data is stored in managed AWS RDS with automated daily backups and point-in-time recovery. We continue to validate our restore procedures as we grow.
Data protection & breach response
We are building CXOLens to align with India’s Digital Personal Data Protection Act, 2023. For data inside the product we act as your Data Processor, processing it on your instructions. In the event of a personal-data breach, we will act to contain it and will notify affected parties and the Data Protection Board of India as required by law.
Honest about our stage
We build to the intent of recognised frameworks such as ISO 27001 and SOC 2 — least privilege, tenant isolation, encryption, audit logging and secure development. To be transparent, we are not yet formally certified against those standards, and we do not claim certifications we do not hold. As we grow we intend to pursue formal assessment. No system is perfectly secure, but we work continuously to protect your data and to be straight with you about where we are.
Reporting a vulnerability
If you believe you have found a security issue, please email admin@cxolens.in with the details. We appreciate responsible disclosure and will work with you to verify and address genuine issues promptly.