Security & Vulnerability Disclosure Policy

Security and Data Protection at Innoventry

At Innoventry Software, security, data integrity, and multi-tenant isolation are core architectural commitments. Thousands of Indian businesses rely on Innoventry ERP to manage their accounting, GST billing, inventory, and point-of-sale operations. We maintain rigorous administrative, technical, and physical safeguards to ensure that customer data remains confidential, tamper-proof, and resilient.

This document describes our security standards, architectural controls, and our Coordinated Vulnerability Disclosure Policy aligned with RFC 9116.

Coordinated Vulnerability Disclosure Policy

We deeply value the security research community and ethical hackers who help us protect our users and infrastructure. If you believe you have discovered a security vulnerability in any Innoventry service or application, we encourage you to report it to us immediately.

How to Report a Vulnerability

Please send all vulnerability reports directly to: support@innoventrysoftware.com

To assist our security team in assessing and resolving the report quickly, please include: * The affected endpoint, URL, or software component (e.g. cloud webapp, desktop package, mobile app, API wrapper). * A clear description of the issue, vulnerability classification (e.g. CWE-22, CWE-306, CWE-434), and potential impact. * Step-by-step reproduction instructions or a minimal, non-destructive proof-of-concept (PoC). * Your name, handle, or contact details if you would like to be acknowledged.

Our official RFC 9116 security text file is published at: https://appserver.innoventrysoftware.com/.well-known/security.txt

Safe Harbor & Research Guidelines

We consider security research conducted within the scope of this policy to be authorized and in good faith. Innoventry will not initiate legal action against researchers who comply with the following principles: * Do not access, download, view, or alter data belonging to other companies or users. If a vulnerability exposes access to customer files or databases, halt testing and report it immediately with a benign non-existent file or benign probe. * Do not execute Denial of Service (DoS/DDoS) attacks, automated brute-force attacks against login forms, or resource exhaustion. * Do not engage in phishing, spamming, social engineering, or physical security attacks against Innoventry personnel or facilities. * Do not publicly disclose or share details of the vulnerability until Innoventry has investigated, addressed the issue, and verified the fix across production environments (allowing a minimum 60-day remediation window).

Our Response Commitments

When you report a security issue in accordance with this policy: * We will acknowledge receipt of your report within 24 to 48 business hours. * We will maintain transparent communication, provide status updates during triage, and notify you once the fix has been verified and deployed. * We will publicly credit your contribution in our Security Hall of Fame (unless you prefer anonymity).

Application & Product Security

• Tenant Isolation & Zero Context Leakage: Innoventry employs strict logical isolation across tenants. Database sessions, ThreadLocal contexts, and company parameters are bound per-request and sanitized upon completion, preventing cross-tenant leakage.
• Authentication & Signed JWTs: API access is governed by signed HMAC-SHA512 JSON Web Tokens (JWT) with restricted lifetimes, refresh token rotation, and API key authentication with role-based authorization (RBAC).
• Zero Runtime DDL: Application runtime code never executes dynamic DDL statements. Database schemas, column modifications, and indexes are managed exclusively through versioned, audited delta upgrade scripts.
• Path Traversal & Archive Defense: File upload and download endpoints enforce canonical path boundaries, strictly rejecting directory traversal sequences (such as relative dot-dot paths, null bytes, and path escape attempts) and mitigating Zip Slip vulnerabilities.
• Administrative API Shielding: Admin-level and billing services are protected with dedicated security filters; internal balance and billing APIs are annotated with security tags that strictly exclude them from dynamic tool reflection.

Infrastructure & Network Security

• Encryption in Transit: All communications between desktop clients, mobile applications, web browsers, and hosted servers are encrypted using modern Transport Layer Security (TLS 1.2 and TLS 1.3) with strong cryptographic cipher suites.
• Encryption at Rest: Databases, storage volumes, and cloud backups are encrypted at rest using AES-256 standard encryption.
• Edge & Reverse Proxy Protection: Production servers reside behind reverse proxies with pre-routing traversal inspection, strict rate-limiting on public API endpoints, and direct internet shielding of internal diagnostic endpoints.
• Continuous Testing & Quality Gates: Code modifications must pass automated security audits, static code analysis, strict OSGi modularity checks, and multi-tier test suites before deployment.

Security Contacts

If you have questions regarding our security architecture or wish to report a suspected incident: * Security & Support Email: support@innoventrysoftware.com * Corporate Address: 502, Crossroads, Bhumkar Chowk, Wakad, Pune, Maharashtra – 411057