Security Standards
Security audit: 18 Aug 2026
Platform Security & Trust
How RotaSphere safeguards delegate personal data, secures online transactions, and enforces cryptographic gate admission integrity.
1. Cryptographic Single-Use QR Pass Integrity
Traditional static barcode tickets can be screenshotted and shared across multiple attendees. RotaSphere eliminates ticket fraud through SHA-256 HMAC cryptographic tokenization:
- Each QR pass contains a digitally signed token verified only against our secure gate validation endpoint.
- Once a pass is scanned at the venue entrance, its state changes to
CHECKED_INwith an immutable timestamp. - Subsequent duplicate scan attempts alert the gate operator immediately and flag the attempt in our security audit log.
2. Multi-Tenant Row Level Security (RLS)
RotaSphere enforces strict database-level data isolation using PostgreSQL Row Level Security (RLS). Club organizers and event staff can strictly query only attendee records registered for their own events. Cross-club data leakage is impossible at the database engine layer.
3. End-to-End Encryption & Edge Protection
- In-Transit: Enforced TLS 1.3 with HSTS (HTTP Strict Transport Security) on all domain endpoints.
- At-Rest: Database storage and sensitive fields are encrypted with AES-256.
- Edge Security: Cloudflare Web Application Firewall (WAF) mitigates DDoS attacks and automated scraping bots.
4. Responsible Vulnerability Disclosure Program
We welcome security researchers to test and improve our platform security. If you discover a vulnerability, please report it directly to:
Email: tech.rotaract3192@gmail.com
Please provide reproduction steps and allow 48 hours for our security team to investigate before any public disclosure.
Check live platform availability
View real-time status of APIs, gateway, and scanning services.