Security Architecture

We employ multi-layered security controls to safeguard your data against modern threats. From edge networking to database storage, security is embedded into every tier of our SaaS platform.

1. Encryption

In Transit: All communications between your users, our applications, and our databases are encrypted using TLS 1.3. We do not support legacy or insecure protocols.

At Rest: All data stored in our primary MongoDB databases, including daily backups, is encrypted at rest using AES-256 encryption. We employ Application-Level Encryption (ALE) for highly sensitive fields, ensuring data remains unreadable even in the event of a database compromise.

2. Infrastructure Security

Our infrastructure is hosted on robust cloud providers (AWS) within the Mumbai (ap-south-1) region, guaranteeing data localization compliance for Indian merchants. We utilize:

  • Edge Protection (WAF): A Web Application Firewall automatically inspects incoming traffic, dropping malicious requests and mitigating distributed denial-of-service (DDoS) attacks.
  • VPC Isolation: Our databases and internal microservices reside in private subnets with no direct public internet access. Ingress is tightly controlled via API Gateways.
  • Immutable Deployments: Infrastructure as Code (IaC) ensures repeatable, secure, and fully audited environment deployments.

3. Authentication & Access Control

  • For Merchants: We mandate complex passwords and offer Multi-Factor Authentication (MFA) via TOTP. Authentication sessions are managed securely with HttpOnly, Secure, and SameSite cookies.
  • Internal Access: NowMe.live employees are granted access to production systems under a strict "Principle of Least Privilege". Access requires zero-trust VPNs, hardware security keys, and all internal actions are heavily audited.

4. Vulnerability Management & Monitoring

Security is a continuous process. We perform automated Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) within our CI/CD pipelines. Third-party dependencies are scanned daily for known CVEs. Our Security Operations Center (SOC) monitors system logs 24/7 to detect and alert on anomalous activities in real-time.