Trust & Infrastructure
Security & Data Protection Architecture
Technical overview of how FinSetu safeguards client sessions and financial calculations.
Encryption & Session Token Security
• All HTTP requests force HTTPS via HTTP Strict Transport Security (HSTS).
• Passwords are hashed using bcrypt with salt rounds before database storage.
• Session tokens are transmitted exclusively in HTTP-only, SameSite=Lax encrypted cookies.
Rate Limiting & Input Sanitization
• API endpoints implement sliding-window rate limiting to prevent brute-force attacks.
• User input payloads are sanitized using HTML entity encoding to prevent Cross-Site Scripting (XSS).
• strict Content-Security-Policy (CSP) headers block unauthorized cross-site frame embedding.