At Maharaja Agrasen Foundation Limited Singapore, security is integrated into every layer of our global community directory. We recognize the trust you place in us when providing family details and verification documents, and we implement strict technical measures to protect your personal data.
1. Database Isolation & Supabase RLS
Our PostgreSQL database enforces strict **Row Level Security (RLS)** policies on all tables. This means that anonymous web requests from the browser cannot query, read, or modify database tables. All standard data queries are processed exclusively through secure, server-side Next.js Server Actions connecting as a database owner.
2. Cryptographic Secret Management
All sensitive credentials (including Supabase API credentials, database URIs, Pusher socket credentials, and authentication secrets) are stored in secure environment variables within the hosting infrastructure (Vercel Project Dashboard). The codebase contains **zero hardcoded fallback secrets**. If an environment variable is misconfigured or missing, the server actions will fail immediately rather than resorting to an insecure default.
3. OTP Authentication & Anti-Brute-Force Guarding
We do not store passwords. Users authenticate securely via WhatsApp, SMS, or Email One-Time Passcodes (OTP). Our OTP system utilizes a rate-limiting database table (`otp_rate_limits`) that tracks requests and verification attempts per recipient and IP address. This mitigates brute-force attacks and prevents abuse.
4. Field Masking & Reveal Audits
To prevent profile scanning, contact details and dates of birth are dynamically masked on the server. Unauthenticated users cannot view member details. In addition, reveal operations for verified members are audited and rate-limited.
5. Secure Communications & CSP
All data transmission is encrypted via HTTPS with TLS 1.3. We implement strict HTTP response security headers in `next.config.ts`, including a detailed **Content Security Policy (CSP)** that restricts script execution, style loading, and media origins to prevent cross-site scripting (XSS) and code injection.