Your agency's data deserves
straight answers, not badges.
Here's exactly how we handle access, isolation, encryption and protection — no logo wall, no marketing fluff.
Security layers active
Security practices
How we protect your agency's data
Every line of code is written with security in mind. Here are the core layers protecting your data today.
Tenant Isolation
Every agency's database records are strictly isolated by a tenant ID. One agency can never view or modify another's campaign or client details.
Data Encryption
API keys and credentials are encrypted at rest with AES-256. Web traffic is secured with 256-bit SSL/TLS encryption in transit.
Access Protection
Passwords hashed using strong Bcrypt algorithms. Optional multi-factor authentication (TOTP 2FA) protects user and client portals.
Threat Mitigation
Parameterized SQL queries eliminate SQL injection vectors. Output is sanitised to block Cross-Site Scripting (XSS) threats.
Backups & Redundancy
Automated daily backups with redundant snapshots on a rolling schedule. Fast recovery with minimal data loss windows.
Secure Payments
Card processing handled securely by Razorpay. Zero payment details or card numbers touch or reside on our servers.
Deep dive
How each layer works
- Passwords are hashed with bcrypt (
password_hash()) — never stored in plain text, never reversible. - Optional two-factor authentication (TOTP — Google Authenticator / Authy compatible) for agency and client portal logins, with rate-limited verification (5 attempts per 15 minutes) so a stolen password alone isn't enough.
- Password resets use a one-time 6-digit code emailed to the account holder — the code itself is never stored, only its SHA-256 hash, and it expires after 10 minutes and works once.
- Login attempts are rate-limited by IP (5 attempts per 15 minutes) to slow down password-guessing.
- Sessions use
httponly,secure,samesitecookies, and every state-changing action is protected against cross-site request forgery (CSRF).
Every agency's data — clients, campaigns, leads, reports, team members — is scoped to that agency's own tenant ID at the database layer. One agency's admin account cannot query, view, or modify another agency's data. Client portal logins are further isolated from the agency's own admin tools: a client sees only their own campaigns and reports, never another client's.
- All traffic to the platform is encrypted with 256-bit SSL/TLS.
- Third-party API credentials your agency connects (ad platform tokens, integration keys) are encrypted at rest with AES-256, not stored as plain text in the database.
- One-time codes and session tokens are stored only as SHA-256 hashes — even direct database access wouldn't expose a usable, reversible value.
- Hosted on servers located in India.
- Automated daily database backups, retained on a rolling schedule — 7 daily, 4 weekly, and 12 monthly snapshots — so recovery isn't dependent on a single most-recent copy.
- Payments are processed through Razorpay — card and bank details are handled by Razorpay directly and never touch our servers.
Every database query in the platform uses parameterized statements — no raw user input is ever concatenated into SQL. Output is escaped before rendering to prevent cross-site scripting (XSS). File uploads are validated against their real file content (not just the filename), so a disguised file can't be stored as something it isn't. Access to internal configuration, environment files, and admin-only tooling is blocked at the web-server level.
Sign-ins, admin actions, and sensitive changes within an agency's account are logged with the acting user, timestamp, and IP address — visible to the agency owner and platform administrators, so unusual activity can be traced and reviewed.
Compliance & security standards
We prioritize user data privacy, secure cloud infrastructure, and robust encryption protocols. If your agency has custom compliance questionnaires or specific audit requirements, please reach out to our team at support@agencynest.in.
Security Report
Found a
security issue?
If you believe you've found a vulnerability, please report it directly — we'll acknowledge and respond as quickly as we can.