Security

Last updated: 08/24/2026

What we actually do today, stated plainly — including what we don't have yet, since an honest gap is more useful to you than a page that oversells.

Authentication

MFA (TOTP/Google Authenticator) and per-account lockout after repeated failed login attempts, on top of rate-limited login/signup endpoints and Cloudflare Turnstile bot checks against scripted abuse.

Encryption

Passwords hashed with bcrypt; sensitive fields such as MFA secrets encrypted at rest with AES-256-GCM.

Transport security

TLS terminated at our reverse proxy for every host, with modern cipher configuration and HSTS. Independently graded A+ by Qualys SSL Labs.

External testing

A manual OWASP Top 10 code review and dependency audit, plus external scans against the live site (SSL Labs, Nmap, OWASP ZAP, and a Greenbone/OpenVAS vulnerability scan) — zero critical or high findings across all of them. Re-run periodically, not a one-time check.

Backups & monitoring

Automated, verified database backups and independent external uptime monitoring, so an incident is caught and recoverable, not just logged.

Per-tenant isolation & quotas

Every tenant's API access is authenticated and rate-limited independently at the engine level — one tenant's usage can't degrade another's.

What we don't have yet

We haven't completed a SOC 2 or ISO 27001 certification, and we haven't commissioned a formal, credentialed third-party penetration test — the external testing above is free/automated tooling plus a manual code review, a real baseline but not a substitute for either. We're a small team and these are on our roadmap, prioritized as real customer needs justify them.

Performance & accessibility

Google PageSpeed Insights, run against inzinx.com on Aug 28, 2026 at 3:58 PM IST: 90 Performance / 100 Accessibility / 100 Best Practices / 100 SEO on mobile, and 100 across all four on desktop. Scores like these fluctuate run to run (network conditions, not code changes) — this is one dated snapshot, not a permanent guarantee. Run it yourself for a live result.

That's the marketing site. For the API itself, we load-tested on the smallest cloud instance available to establish a worst-case floor: 543 requests/second, 185ms p95 latency, zero errors, over real TLS. See the full results.

Report a vulnerability

If you believe you've found a security vulnerability in Inzinx, we want to know about it. Please report it privately rather than disclosing it publicly first.

Contact: hello@inzinx.com
Response time: we aim to acknowledge every report within 24 hours.
In scope: inzinx.com, app.inzinx.com, and api.inzinx.com.
Out of scope: third-party services we don't control (our payment processor, analytics, or cloud provider), denial-of-service testing, and social engineering against our team or users.

Safe harbor: we will not pursue legal action against researchers who make a good-faith effort to comply with this policy — testing only in-scope targets, avoiding privacy violations and service disruption, and reporting privately before any public disclosure.

We also participate in coordinated disclosure through Open Bug Bounty, for any researcher who prefers reporting through a third-party platform rather than directly.