Data Security Policy

1. Security Commitment

Vinti Web Solution implements robust Technical and Organizational Measures (TOMs) to safeguard personal, biometric, and financial data against accidental loss, unauthorized access, alteration, or disclosure, adhering to Section 8(5) of the Digital Personal Data Protection Act, 2023.

2. Authentication & Access Architecture

• Role-Based Access Control (RBAC): Granular permissions govern access across departments, salary structures, leave records, and employee documents. Staff cannot access confidential compensation data of other employees.
• Password Security: Passwords are cryptographically salted and hashed using standard industry algorithms (Bcrypt). Plaintext passwords are never stored or logged.
• Single-Device Concurrency Control: The platform actively detects and prevents simultaneous concurrent logins across separate devices, safeguarding accounts from session hijacking.
• Rate Limiting & Brute Force Protection: Authentication endpoints enforce strict throttling to mitigate automated credential stuffing attacks.

3. Data Transmission & Storage Encryption

• Data in Transit: All HTTP traffic is encrypted using Transport Layer Security (TLS 1.2 / TLS 1.3) with modern cipher suites. Insecure HTTP connections are automatically redirected to HTTPS.
• Data at Rest: Database backups, sensitive user vault items, and uploaded document attachments are stored in secure, permission-restricted directory structures.
• Sensitive Token Protection: Session identifiers and CSRF tokens utilize HttpOnly and SameSite cookie attributes to defend against Cross-Site Scripting (XSS) attacks.

4. Network & Infrastructure Defenses

• Database ports are isolated and inaccessible from the public internet.
• WebRTC peer signals for in-app video conferencing utilize direct end-to-end media encryption.
• Administrative activity logs audit sensitive role modifications, salary adjustments, and document verifications.

5. Employee & Administrative Confidentiality

Administrative personnel with access to backend databases are bound by strict non-disclosure obligations and access records solely on a need-to-know basis for operational maintenance.