Security Policy

We build systems with security in mind. Our developers follow OWASP (Open Web Application Security Project) guidelines to prevent vulnerabilities such as SQL injection, Cross-Site Scripting (XSS), and broken authentication.

Every project undergoes a security review prior to production launch to check that packages are up-to-date and configuration variables are set correctly.

All communication with our websites and client applications is encrypted using industry-standard SSL/TLS protocols (HTTPS). Sensitive customer data — including database passwords, user login keys, and session identifiers — are encrypted at rest using AES-256 standard encryption algorithms.

We use secure password managers to store client credentials. Access is strictly limited on a need-to-know basis. Developers only get access to the specific resources needed to complete their assigned tasks. Multi-Factor Authentication (MFA) is required on all developer cloud logins.

We set up daily automated database backups for our managed hosting setups. Backups are stored in separate, secure cloud servers to prevent data loss in the event of hardware failure. Disaster recovery procedures are tested periodically.

We welcome reports of security vulnerabilities. If you discover a bug or security loophole on any RootThrive site or managed platform, contact us at rootthrive.business@outlook.in. We prioritize security patches and fix confirmed issues immediately.