Security & Data Protection

Effective Date: 28 March 2026  |  Last Updated: 21 October 2026  |  Version: 2.0

This page describes how PredictX protects your data and the platform. Sections 1 to 6 describe what is in place today; section 7 lists what we are still building.

1. Infrastructure

  • Hosted on Amazon Web Services in Mumbai (ap-south-1), with content delivered through Amazon CloudFront
  • The database and cache sit inside a private network and are not reachable from the internet
  • The production database runs across multiple availability zones; application services auto-scale
  • AWS Shield Standard DDoS protection, applied automatically by AWS
  • Container images are scanned for known vulnerabilities when they are pushed
  • Infrastructure is defined as code and changed through reviewed commits

2. Encryption

  • In transit: HTTPS only, TLS 1.2 or higher, with HSTS on website responses. Real-time features use WebSocket over TLS.
  • At rest: the database and its backups are encrypted with a customer-managed AWS KMS key; the Redis cache is encrypted at rest; application secrets are held in AWS Secrets Manager.

3. Sign-in and access

  • Google or Apple sign-in. PredictX stores no user passwords. Phone and email one-time-code sign-in has not been offered since 18 August 2026.
  • Sessions: signed tokens, with refresh tokens held on our servers and revoked when you sign out. On the website your tokens never reach the browser — it holds only an encrypted httpOnly session cookie.
  • Admin access: a separate sign-in with hashed passwords, sessions that expire after 24 hours and can be revoked, super-admin-only access to the most sensitive actions, and an audit log of admin actions.
  • Device records and IP address signals are used to detect fraud and multiple accounts.

4. Application security

  • Every endpoint that reads or changes account data requires a user session, an admin session or an API key; sign-in and public read-only endpoints are rate-limited
  • Rate limiting on the API, with tighter limits on sensitive endpoints
  • Parameterised database queries
  • Content Security Policy on the website
  • Cross-origin requests to the website's authenticated endpoints are rejected
  • Token-balance changes are written to an append-only ledger in the same database transaction as the change

5. Backups

The database is backed up automatically every day, with point-in-time recovery, and backups are kept for 30 days in the Mumbai region. Deletion protection is enabled on the production database. A copy in our previous hosting account, made before the move, is being deleted; it is not used to run the service.

6. Incidents and personal data breaches

Operational alarms are routed to the team, and website errors are reported to our error-monitoring service. If a personal data breach happens, we follow a written breach procedure: we contain it, preserve evidence, inform the Data Protection Board of India without delay and send it a detailed report within 72 hours, as the DPDP Rules, 2025 require, and tell every affected person in plain language what happened, what data was involved and what they can do. See our Privacy Policy §14.

7. Planned / in progress

These are not in place yet. We will move each one up this page when it is live.

  • AWS CloudTrail audit logging and Amazon GuardDuty threat detection
  • Keeping application and security logs for one year (currently 30 days)
  • Encryption in transit between our application and its cache and database inside the private network
  • A web application firewall or IP allowlist in front of the admin dashboard
  • Multi-factor authentication for admin sign-in
  • Hashing refresh tokens at rest, and audit logging of admin views of user details

PredictX does not currently hold a security certification such as ISO 27001 or SOC 2.

8. Reporting a vulnerability

If you find a security issue:

  • Email details to security@thepredictx.com
  • Include steps to reproduce the issue and its likely impact
  • Allow us reasonable time (90 days) to fix it before public disclosure
  • Do not access, modify, or delete other users' data

We aim to acknowledge reports within 48 hours and to keep you updated while we investigate. Our contact details are also published at /.well-known/security.txt.

Contact

Security concerns: security@thepredictx.com

Privacy & data protection: privacy@thepredictx.com

Grievances: grievance@thepredictx.com