How we protect your data

Every byte exchanged between your device and EZWeddingz is encrypted using TLS 1.2 or TLS 1.3 (HTTPS). This applies to:

• Website and mobile-app browsing (www.ezweddingz.com)
• API requests from app or browser to our servers
• Connections between our application servers and MongoDB Atlas database
• Image and document uploads to Cloudinary
• Google OAuth sign-in
• Future payment processing via Razorpay (industry-standard PCI-DSS gateway)

HTTP Strict Transport Security (HSTS) is enforced — browsers will refuse to load the site over plain HTTP for one year after the first secure visit.

• MongoDB Atlas — entire database encrypted with AES-256 (managed by Atlas / AWS KMS)
• Cloudinary assets — encrypted with AES-256 on object storage
• Encrypted backups — automatic daily backups, also AES-256 encrypted, retained for 30 days

On top of database-level encryption, the following fields are additionally encrypted at the application layer before they ever touch the database, using AES-128 + HMAC-SHA256 (Fernet):

• GST Number
• PAN Number
• Bank Account Number
• Bank IFSC Code
• Aadhaar (where collected — not yet, but field is protected)

The encryption key is stored separately from the database. Even an attacker with full database access cannot read these fields without the application-layer key.

• Passwords are hashed with bcrypt (cost factor 12) — slow, salted, designed to resist GPU brute-force attacks
• We never store passwords in plain text. Our staff cannot see your password
• Google-authenticated accounts have no password on our side — sign-in goes directly through Google

Every response from our API includes hardened security headers:

• Strict-Transport-Security (HSTS preload) — forces HTTPS for 1 year
• Content-Security-Policy — restricts which sources can load scripts, frames, fonts and media
• X-Frame-Options: DENY + frame-ancestors 'none' — protects against clickjacking
• X-Content-Type-Options: nosniff — blocks MIME-sniffing attacks
• Referrer-Policy — only sends origin, not the full URL, when navigating to third parties
• Permissions-Policy — disables browser APIs we don't use (camera, microphone, USB, magnetometer)

• Role-based access — Customer, Vendor (Owner + Manager), Field Executive, and Admin scopes are strictly isolated
• JWT tokens are signed with HS256 and expire after a fixed lifetime
• Soft-deleted accounts are immediately rejected at the authentication layer
• Admin actions are gated behind a separate, obscure portal URL with no public links

• Digital Personal Data Protection Act, 2023 (DPDP) — India's primary data-protection law. We collect lawful, minimal data and provide deletion + grievance contacts
• Income Tax Act, 1961 & GST regulations — booking and payment records retained for 8 years as required
• Google Play Data Safety — our deletion policy is published at /account/delete
• PCI-DSS — we never store card data; payments are processed by Razorpay (PCI-DSS Level 1 certified)

If you believe you've found a vulnerability, please email security@ezweddingz.com. We acknowledge reports within 48 hours and aim to remediate critical issues within 7 working days.

Please don't publicly disclose until we've had a chance to fix it. We don't currently run a paid bug-bounty programme, but we'll acknowledge you in our security hall of fame and send a thank-you gift for substantive reports.