Infrastructure Security
- All data transmitted over TLS 1.2+ enforced via HSTS
- Passwords hashed using Argon2id (OWASP recommended standard)
- CSRF tokens on all state-changing requests
- Rate limiting on authentication endpoints
- Full Content Security Policy headers active
- X-Frame-Options: SAMEORIGIN - iframe embedding blocked
- PHP version and server fingerprints suppressed in all HTTP responses
- Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Document Storage
NGO documents are stored in an access-controlled environment with randomised filenames, not accessible via predictable URLs. Documents are accessible only to the uploading NGO and PATVAAR verification team. Funders never see raw documents.
Funder access: CSR funders see only your Trust Score, pillar breakdown, and verification status badges. Document sharing requires explicit NGO consent.
Access Controls
| Role | What They Can Access |
|---|---|
| NGO | Own profile, own documents, own Trust Score, incoming EOIs |
| CSR Funder | Public NGO profiles, Trust Scores, pillar breakdowns - no raw documents |
| PATVAAR Verification Team | Documents for verification only - logged access |
| Public | Published Trust Scores and NGO profiles only |
Current Security Headers
- Content-Security-Policy: full policy active
- X-Content-Type-Options: nosniff
- X-Frame-Options: SAMEORIGIN
- Referrer-Policy: strict-origin-when-cross-origin
- Permissions-Policy: camera, microphone, geolocation, payment all blocked
- Strict-Transport-Security: 1 year with preload
Current status: PATVAAR is on shared hosting infrastructure. Dedicated server migration is planned for Q3 2026 as part of ISO 27001 certification. ISO 27001 target: Q4 2026.
Vulnerability Disclosure
Security researchers who discover vulnerabilities are encouraged to report them to hello@patvaar.com. We respond within 48 hours and resolve within 7 working days.
Our security.txt is published at patvaar.com/.well-known/security.txt following RFC 9116.