Built for High-Assurance Identity & Trust
Security is not an add-on; it is the core foundation of AuthSetu. We implement strict defense-in-depth, cryptographic hygiene, and complete data residency within India.
Cryptographic Hygiene
Passwords hashed with memory-hard Argon2id (RFC 9106) with random 16-byte salts and server-side pepper. TOTP secrets encrypted with AES-256-GCM. JWT tokens signed with asymmetric Ed25519 keys.
India Data Residency
All production databases, Redis caches, and document stores are hosted exclusively within AWS ap-south-1 (Mumbai, India), ensuring compliance with RBI and DPDP Act 2023 data localization requirements.
Zero-Knowledge API Secrets
Secret API keys (as_live_...) are shown exactly once upon creation. Keys are hashed at rest using cryptographically salted SHA-256 with constant-time verification.
Detailed Technical Safeguards
Every database query strictly filters by org_id. Multi-tenant access controls are enforced at both middleware and repository layers.
All outbound webhook dispatches resolve IP addresses at connection time and reject private, loopback, link-local, and AWS cloud metadata (169.254.169.254) addresses.
Accounts are locked for 15 minutes after 5 consecutive failed sign-in attempts. Password reset tokens use anti-enumeration uniform timing.
Identity documents and DigiLocker XML payloads are never exposed via public URLs. Authorized downloads utilize short-lived (15-minute) signed presigned tokens.
Enforced HSTS (max-age=31536000; includeSubDomains; preload), TLS 1.3, Cloudflare edge DDoS mitigation, and cryptographically signed DNSSEC records.
Every API key issue, MFA toggle, session revocation, and verification attempt is permanently logged with IP, User-Agent, and actor metadata.
Vulnerability Disclosure
If you discover a security vulnerability in AuthSetu, please contact us immediately at security@authsetu.com. We operate a safe-harbor policy for ethical security researchers. See our security.txt.