Security at MAPPIN

Security is fundamental to everything we build at MAPPIN. Here's an overview of how we protect your data and your API traffic.

1. Data Encryption

• In transit: all API traffic uses TLS 1.2+ (HTTPS)
• At rest: databases are encrypted using AES-256
• Secrets: API keys, passwords, and tokens are never stored in plain text

2. Authentication

• Passwords are hashed using industry-standard algorithms (PBKDF2 with SHA-256)
• API keys are unique per partner and can be rotated at any time from the dashboard
• Sessions expire automatically after 30 minutes of inactivity

3. Rate Limiting & Abuse Protection

• Per-partner daily, monthly, and burst limits
• IP-level abuse detection (auto-block on suspicious traffic)
• Token-bucket algorithm for smooth burst handling

4. Infrastructure Security

• Hosted on hardened Linux servers with automated security patching
• Web Application Firewall (WAF) via Nginx
• Regular database backups with off-site retention
• Monitored 24/7 for anomalies

5. Payment Security

All payments are processed by HDFC SmartGateway, a PCI DSS compliant payment gateway. We never see or store your card details.

6. Responsible Disclosure

Found a security issue? Please report it responsibly to assist@rpconnect.travel. We aim to acknowledge reports within 24 hours and appreciate you giving us reasonable time to fix issues before public disclosure.

7. Contact

Security questions? Email assist@rpconnect.travel.