Security Overview

How DamanPharma protects your pharmacy, in plain language — for pharmacists and their advisors.

Isolation at the database layer

Every pharmacy's rows are guarded by PostgreSQL row-level security keyed to the tenant of the request. Cross-tenant access is impossible at the database layer, not merely forbidden by application code.

Authentication

Argon2id password hashing, minimum 12 characters, optional TOTP two-factor authentication for staff and enforced expectations for platform staff. Sessions are server-side with idle and absolute timeouts; a password reset signs out every session.

Transport & application hardening

TLS everywhere with HSTS, a strict same-origin content security policy (no third-party code can ever load), CSRF protection on every state-changing request, rate limiting, and request size limits.

Auditability

Append-only, hash-chained audit logs — the database revokes UPDATE and DELETE on them, and every entry is cryptographically chained to the previous one so tampering is detectable — record security-relevant actions, visible to you for your own tenant. Every controlled-substance sale is attributed to the acting user.

Operations

Single-purpose hardened server: firewall allowing only web traffic and rate-limited SSH, fail2ban, unattended security upgrades, sandboxed service with zero capabilities, nightly off-box backups, and vulnerability scanning in CI on every change.

Privacy Policy