Security

Security is part of how we build, not an add-on. This page summarizes the controls that apply to the products we operate, including ImRep. Customers can request a detailed security overview and our Data Processing Agreement by email.

Architecture

• Isolation per Client. Each customer runs on its own application stack and database. There is no shared database between companies.
• Encryption. All traffic uses TLS. Server disks and backups are encrypted. Mobile apps store data in encrypted local storage.
• Authentication. Passwords are hashed with Argon2. Sessions use short-lived signed tokens that can be revoked. Administrator access requires multi-factor authentication.
• Access Control. Roles are enforced on the server with deny-by-default permissions. Field users see only the records assigned to them.
• Audit Trail. Changes to records are written to an append-only audit log with the actor and timestamp.

Operations

• Hosting. Production systems run in the Singapore region of reputable cloud providers, behind a reverse proxy with automatic certificate management.
• Backups. Nightly encrypted backups are stored off-site in a separate provider and restore procedures are tested.
• Monitoring. Uptime, errors and failed backups raise alerts. Dependencies are scanned and patched on a regular cadence.
• Secrets. Credentials are kept out of source control and rotated when staff or systems change.

Reporting a Vulnerability

If you believe you have found a security issue in any Maservitech system, email [email protected] with the details and steps to reproduce. We acknowledge reports within two business days and do not take legal action against good-faith research that avoids data access, service disruption and public disclosure before a fix.