Security at ArcBooks

Last updated: October 30, 2026

Your business records deserve careful protection. ArcBooks is built with layered safeguards for sign-in, data access and subscription administration.

Authentication

• Passwords are hashed before storage.
• Sessions use signed, HTTP-only cookies.
• Password reset invalidates older sessions through a session version.
• Email verification is used before normal sign-in where required.

Application security

• Server-side validation is applied to sensitive API inputs.
• Authentication and token endpoints use request rate limits.
• Security headers, including HSTS, keep browser connections protected.
• Service secrets are loaded from deployment environment variables rather than source code.
• Subscription entitlements and limits are checked server-side rather than relying only on browser UI.

Staff & Salary

• Staff, attendance and salary data can be opened only by the Owner, Admin and Accountant roles; other roles do not see the section.
• Self punch links use a long random token and a 4 to 6 digit PIN that is stored hashed.
• The Attendance desk link and PIN let a supervisor mark attendance only; it exposes no salary, accounting or other data, and times are always recorded by the server.
• The monthly salary shown on a staff link needs the PIN, covers only that person, and can be switched off per person.
• Repeated wrong PINs temporarily lock the punch link.
• Self punch can only mark that staff member's own attendance for the current day; it cannot read salary or other staff data.

Keeping your account safe

• Use a unique password and keep your email account secure.
• Grant team members only the roles and permissions they need, and remove access when it is no longer required.
• Use available backup and export features and keep an independent copy of important business records.
• Sign out of shared devices and review active sessions in Settings when available.

Subscription and payment safety

ArcBooks currently uses a sales-assisted subscription workflow; there is no in-app payment gateway checkout. An authorised administrator activates access after confirming payment. Use only the written payment instructions supplied by ArcBooks, keep your receipt or transaction reference, and never share passwords, OTPs, card PINs or banking credentials with support.

Admin access

Primary Admin Panel access uses an additional verification flow. Individual subscription and limit changes are restricted to the primary owner and are recorded in the audit log.

Security logging

ArcBooks records relevant authentication, API and security events to support incident investigation and service integrity. Secrets and passwords are not stored in these logs.

Reporting a security issue

Please report suspected security issues privately to support@arcbooks.in. Do not publicly post credentials, tokens, database connection strings or other sensitive information.