Security & Data Protection
Current Security Baseline: Active Production Implementation
QUIKXE implements industry-standard defense-in-depth security controls based on OWASP ASVS standards. We treat every customer document and piece of personal information as confidential data requiring strict server-side protection.
Private Cloud Storage
Customer documents are stored in private, unguessable storage paths. Access is strictly controlled via short-lived server-generated signed URLs.
Automated Document Purge
Upon confirmed physical printing at the shop, files are automatically destroyed from server memory and cloud storage according to the selected retention policy.
Strict Tenant Isolation
Shop operators and printers can only access print jobs strictly dispatched to their authorized shop ID. Cross-tenant access is blocked server-side.
1. Technical Security Controls
Encryption in Transit
All communication is enforced over TLS/HTTPS with HSTS preload and Strict-Transport-Security enabled.
Cryptographic Session Tokens
Operator sessions use HMAC-SHA256 signed tokens stored in secure, HttpOnly, SameSite cookies to resist XSS and session hijacking.
Sliding-Window Rate Limiting
High-risk endpoints (logins, uploads, payment webhooks) are protected against brute force and request flooding.
Binary Magic Bytes Inspection
All uploaded files undergo deep binary magic bytes validation to reject masquerading executables (.exe, ELF, Mach-O).
2. Payment & Financial Security
QUIKXE never stores customer credit card numbers, CVVs, netbanking passwords, or UPI MPINs. All payment transactions are handled through RBI-authorized payment aggregator Cashfree Payments. Webhook notifications from payment gateways are cryptographically verified using HMAC signatures, and idempotent transaction logic guarantees that duplicate payment callbacks do not create duplicate orders or charges.
3. Responsible Vulnerability Disclosure Program
We welcome reports from security researchers and developers to help keep our platform and users safe. If you believe you have discovered a security vulnerability in QUIKXE:
- Please email full technical details and reproduction steps to security@quikxe.com.
- Provide us a reasonable window (at least 30 days) to investigate and patch the issue before disclosing it publicly.
- Do not attempt to access, modify, or destroy real customer documents or data during your testing.
- Do not perform denial-of-service (DoS) attacks or disrupt print shop hardware operations.