Encryption
- All traffic uses TLS 1.3.
- Messages are encrypted in transit and at rest.
- Passwords are hashed with bcrypt + per-user salt.
Infrastructure
- Hosted on SOC 2 Type II certified providers (AWS / GCP).
- Data is stored in your region where possible (EU, US, IN).
- Daily encrypted backups, geographically distributed.
Access controls
- Strict role-based access — only the people who need it, see it.
- All admin access logged and audited monthly.
- 2FA required for all employees and contractors.
Found a vulnerability?
We run a responsible disclosure program. Email security@duncit.com — we respond within 48 hours and reward valid findings.