Security Controls & Architecture

1. Non-Custodial Educational Architecture

MicroInvestments.in does NOT hold investor funds, manage bank balances, or execute securities trades. All tools are quantitative calculators and educational models. Capital remains in your own regulated accounts.

2. Transport Encryption, Passwords & Authentication

• HTTPS / TLS 1.3: All communications between the client browser and servers are encrypted in transit.
• Password Hashing: Passwords are hashed using bcrypt with salted work factors before database storage. Plaintext passwords are never stored.
• Session Authentication: Account authentication relies on HTTP-only secure JWT cookies and bearer tokens with expiration limits.
• Zero Payment Credentials: Card numbers, UPI PINs, and banking credentials are handled exclusively by Razorpay (PCI-DSS compliant). No payment credentials pass through or touch our servers.

3. API Protection & Data Access Controls

• Rate Limiting: API routes (including AI chat and payment creation) enforce IP and user token rate limits to prevent brute-force attacks.
• Parameterized Queries: Database queries execute through Prisma ORM to eliminate SQL injection vulnerabilities.
• Secret Management: Environment variables, database connection strings, and API keys are stored in secure cloud environment stores and never exposed to the client.