Security

LigiComms is built on a security-first architecture:

• All sensitive data is encrypted at rest and in transit.
• Authentication uses short-lived, server-side tokens — never exposed to the browser.
• Every API request is authorised against a dynamic, role-based permission system enforced server-side.
• Tenant data is logically isolated — one tenant can never access another's data.
• Third-party integrations (webhooks, payment callbacks) are cryptographically verified before processing.
• Passwords are stored using industry-standard one-way derivation — they cannot be read, even by us.

• At rest — sensitive credentials (social-media tokens, SMTP passwords, SMS provider keys) are encrypted using authenticated encryption before being stored in the database. Encryption keys are managed separately from the data store and are never committed to source control.
• In transit — all traffic between clients and the platform is served over HTTPS with modern transport-layer security. Internal service-to-service and service-to-database connections are also encrypted.
• Payment data — card numbers and payment secrets are handled entirely by our PCI-compliant payment gateway. They never pass through or are stored on our servers.

• User sessions are managed using short-lived access tokens with automatic rotation. Refresh tokens are single-use and revoked on rotation.
• Tokens are stored server-side — they are never exposed to browser JavaScript or included in URLs.
• Password verification uses a high-iteration one-way key-derivation function with a unique, cryptographically random salt per account. Timing-safe comparison prevents timing attacks.
• Email verification and password-reset flows use single-use, time-limited tokens that are hashed before storage.

• LigiComms uses a dynamic, role-based permission system. Permissions are stored in the database and resolved per request — not hardcoded into the application.
• The platform operator can configure which permissions each role has at runtime, without code changes.
• Every authenticated API request checks the user's current permissions against the required permission for that endpoint. Stale permission caches are short-lived and invalidated on role changes.
• Staff members have restricted permissions — they can view and operate within their assigned scope but cannot manage other staff, change settings, or access billing.

LigiComms is a multi-tenant platform. Strict logical isolation ensures your data stays private:

• Every data operation is scoped to the tenant identifier derived from the authenticated session. Cross-tenant data access is architecturally impossible through normal request flows.
• Channel credentials, wallet balances, messaging settings, content, and contact lists are isolated per tenant.
• Staff can only be invited by their own tenant admin and can only access that tenant's resources.
• Tenant deactivation immediately blocks all access for every user of that tenant — it is reversible by the platform operator.

• Social-media OAuth tokens, bot tokens, SMTP passwords, and SMS-provider API keys are encrypted at rest using authenticated encryption. They are decrypted only at the moment of use (e.g., when publishing a post or sending a message) and never logged or cached in plaintext.
• OAuth flows use PKCE (Proof Key for Code Exchange) where supported by the platform to prevent authorisation-code interception.
• Disconnecting a channel immediately revokes the stored credentials, preventing further use.

• Payment processing is delegated to a PCI DSS-compliant payment gateway. Card details are collected by the gateway's hosted checkout — they never touch our servers.
• Payment confirmation webhooks are verified using cryptographic message authentication codes with replay-window protection to reject stale or replayed callbacks.
• A reconciliation process automatically detects and settles payments whose confirmation was lost in transit, using idempotent operations to prevent double-processing.

• Inbound webhooks from Meta (Facebook, Instagram, WhatsApp), Telegram, and payment gateways are verified using platform-specific cryptographic signatures before any data is processed.
• Webhooks that fail signature verification are rejected immediately and never acted upon.
• Webhook endpoints are configured to fail closed — if the verification secret is not configured, all incoming webhooks are rejected rather than accepted without verification.

• The platform is served exclusively over HTTPS with HTTP Strict Transport Security (HSTS) enabled.
• Response compression is applied to API responses, with authentication endpoints excluded to mitigate compression-based side-channel attacks.
• Media uploads are validated for file type and size, and served through signed, time-limited URLs.
• A health-check system monitors database connectivity and background-job infrastructure, alerting the operations team to degradation.
• A schema-drift guard verifies database integrity at startup, catching missing objects before they cause runtime failures.

• All unhandled exceptions are logged centrally with full context (not user content) and persisted for incident investigation.
• External API interactions (requests to social platforms, SMS providers, payment gateways) are logged for operational visibility and debugging.
• Logs are retained for a limited period and automatically purged. Sensitive data (passwords, tokens, card numbers) is never written to logs.
• The platform operator monitors publish-failure rates, channel health, and payment-reconciliation status through dedicated dashboards.

• We maintain documented procedures for identifying, triaging, containing, and remediating security incidents.
• In the event of a confirmed data breach, affected customers are notified within 72 hours as detailed in our Data Processing Agreement.
• Post-incident reviews are conducted to identify root causes and implement preventive measures.

• AI-assisted features (caption generation, hashtag suggestions) send only the user's prompt text to the AI provider — no personal data, contact lists, credentials, or account information is included.
• Prompts are sanitised to prevent injection attacks before being sent to the AI provider.
• AI usage is rate-limited per tenant and per user to prevent abuse and cost overruns.
• Your content is not used to train AI models.

If you discover a security vulnerability in LigiComms, we'd appreciate your help in disclosing it responsibly. Please report it to info@ligicomms.in with "Security" in the subject line. We ask that you:

• Give us reasonable time to investigate and address the issue before public disclosure.
• Avoid accessing or modifying other users' data during your testing.
• Do not perform denial-of-service attacks or automated scanning that degrades the service for others.

We take every report seriously and will acknowledge receipt promptly.

Security questions or concerns? Reach us at info@ligicomms.in or through our contact page.