Security & Trust

This page describes the real, currently-running security measures behind Relite Solutions' products and this website — not a marketing summary. Every item below is implemented in the codebase today; we'd rather say less than overstate what's in place.

Account & Password Security

Passwords are never stored in plain text. We hash them with ASP.NET Core's PBKDF2-HMAC-SHA512 algorithm, 600,000 iterations, with a unique random salt per password — a NIST 800-63B–aligned scheme, applied to both customer and administrator accounts. Older accounts created under a previous, weaker hashing scheme are transparently upgraded to this one the next time that account signs in, with no action needed from the account holder.

Login attempts are rate-limited per IP address to slow automated password guessing.

Session Security

Sign-in sessions use HTTP-only cookies, which JavaScript running on a page cannot read — a standard defence against session theft via cross-site scripting. Cookies are scoped with a SameSite policy that blocks them from being sent along with most cross-site requests, and are marked Secure (HTTPS-only) whenever the connection itself is HTTPS, which it is in every production deployment.

Encryption in Transit

All production traffic is served over HTTPS; plain HTTP requests are automatically redirected. We also enforce HTTP Strict Transport Security (HSTS) with a one-year policy that covers all subdomains, so browsers that have visited us once will refuse to fall back to an insecure connection even if a link somewhere points to http://.

Every response also carries a set of browser-hardening headers — X-Content-Type-Options, X-Frame-Options, a Referrer-Policy, and a Permissions-Policy — that reduce the surface for content-sniffing, clickjacking, and unnecessary browser feature access.

Encryption at Rest

Sensitive credentials stored on your behalf — such as vault-stored third-party account passwords — are encrypted with AES-256-GCM before being written to the database, using a key held outside the application's source code. Scheduled database backups can likewise be encrypted (AES-256, with a PBKDF2-derived key) and compressed before being written to storage.

Access Control

Administrative access is role-based: Super Admin, Admin, Billing, Support, and Viewer roles each see and can act on only what their role covers, and every administrative page and API enforces this consistently — including the live analytics views, which are gated by the same policy as the rest of the admin panel rather than a separate, easier-to-miss check.

Audit Trail

Administrative actions are recorded to an audit log — who performed an action, what it was, when, and from where — reviewable by administrators. This gives us, and you, a real record to check in the event of a dispute or an investigation, not just server logs that roll over.

Payment Webhook Verification

Payment notifications from our payment gateway are cryptographically signature-verified before we act on them — a request claiming to be a payment notification that doesn't carry a valid signature is rejected outright. Every notification we receive is logged, whether it was accepted or rejected, giving us a complete, honest record of gateway traffic rather than a record of only the requests we chose to act on.

AI Assistant

The AI assistant on this site answers questions using only our public product catalogue — it cannot see any customer, license, or billing data, and it cannot take any action on your account or anyone else's. There is no "approve this AI action" step anywhere on this site today because there is nothing for the assistant to do beyond answering a question: no writes, no account changes, nothing beyond that. Every request is rate-limited, and the assistant is explicitly instructed to say it doesn't know rather than guess.

Dependency & Code Scanning

Every code change is automatically checked against known vulnerability databases before it can be merged — a change that pulls in a software component with a known security vulnerability is blocked, not just flagged. Static code analysis also runs against every change and on a recurring weekly schedule, looking for common security and quality defects before they reach production.

Backups

Databases are backed up on an automated schedule — a full backup weekly and differential backups daily — with automatic retries on failure and a retention policy that keeps recent history without keeping it forever. Backup jobs are themselves monitored, so a silently failing backup doesn't go unnoticed.

Input Handling

Database queries throughout the application are built with parameterized queries rather than assembled from raw text, which is the standard, durable defence against SQL injection — the input you type is always treated as data, never as part of the query itself.

Questions or Concerns

If you believe you've found a security issue with our website or products, we'd genuinely like to hear about it before anyone else does. Email support@relitesolutions.com with what you found and how to reproduce it, and we'll get back to you.

See also our Privacy Policy and Terms and Conditions.