🔒
Data Encryption
- ✓All data in transit is encrypted using TLS 1.2/1.3 (HTTPS). Connections over plain HTTP are automatically redirected to HTTPS.
- ✓Sensitive values stored in our database (tokens, keys) are encrypted at rest.
- ✓File uploads (drawings, documents) are stored with server-side encryption.
🔑
Authentication & Access
- ✓Passwords are hashed using bcrypt with a cost factor of 10 — your plain-text password is never stored.
- ✓Sessions are JWT-based with a 7-day maximum lifetime. Sessions are invalidated server-side on password change or when a new login from another device is detected.
- ✓Rate limiting is enforced on login, registration, and password reset endpoints to prevent brute-force attacks.
- ✓Role-based access control (RBAC) ensures users can only access data belonging to their own organisation.
🖥️
Infrastructure
- ✓The platform runs on a managed cloud VPS with firewall rules restricting unnecessary port exposure.
- ✓The application runs as a dedicated user without root privileges (PM2 process manager).
- ✓Database access is restricted to the application server — the MySQL database is not publicly accessible.
- ✓Redis (used for caching and session tracking) is bound to localhost only.
💾
Backups
- ✓Database backups are performed regularly.
- ✓File uploads are backed up to a separate storage location.
- ✓Backups are retained for a minimum of 30 days.
- ✓Restoration procedures are tested periodically.
👁️
Monitoring & Audit Logs
- ✓All significant actions (login, data export, rate override, member changes) are written to an immutable audit log.
- ✓Failed login attempts are tracked and used to enforce rate limits.
- ✓Server logs are monitored for anomalous patterns.
🔄
Dependency & Code Security
- ✓Dependencies are kept up to date and scanned for known vulnerabilities.
- ✓The codebase follows OWASP guidelines — inputs are validated and sanitised, SQL queries use parameterised statements via Prisma ORM, and XSS protections are enforced by Next.js.
- ✓API endpoints are protected by authentication and tenant isolation — a user cannot access another organisation's data.
🐛 Responsible Disclosure
If you discover a security vulnerability in Estimate Nepal, we ask that you report it to us privately before disclosing it publicly. We take all security reports seriously and will work to fix confirmed issues quickly.
Please email your findings to [email protected] with the subject line “Security Vulnerability Report”. Include a description of the vulnerability, steps to reproduce, and its potential impact.
We do not currently operate a bug bounty programme, but we genuinely appreciate the security community's efforts and will acknowledge responsible reports.
Security page last reviewed: June 2026.