Security at Growthifye
Last updated: June 2026
Last independent security audit: June 2026 — passed
Full-platform code review plus live probing of growthifye.com against the OWASP Top 10 and API Security Top 10. All findings remediated before publication.
How we protect your data
Encryption in transit & at rest
TLS everywhere with HSTS preload. Sensitive records — payroll amounts, Google credentials, Gmail OAuth tokens — are AES-256-GCM encrypted at rest with a key held outside the database.
Two-factor sign-in
Team portal access uses Google sign-in plus a one-time code bound to a trusted device. Idle sessions expire automatically.
Role-based access & approvals
Every module is gated by role and function. Client-facing releases pass a preparer → reviewer → approver chain with a full audit trail.
Network allow-listing
Nexus Suite lets administrators restrict portal access to approved office and VPN IP ranges, with denial logging.
Hardened web edge
Strict Content-Security-Policy, frame-ancestors deny, nosniff, referrer and permissions policies, exact-origin CORS, CSRF verification on every mutating request.
Expiring client links
Client share links carry a 30-day default expiry, can be shortened or revoked instantly, and every open is logged.
Operational practice
- —Security headers, sitemap health and search-engine indexing are monitored nightly; administrators are alerted on regressions.
- —Every privileged action — role grants, approvals, data exports, client-link changes — is written to an immutable audit log.
- —AI features (Vidura) run under daily usage ceilings and never receive client financials without an explicit share toggle.
- —Data is hosted in Kubernetes-isolated containers with MongoDB access limited to the application service account.
- —Back-ups are encrypted and retained per the Privacy Policy; clients may request export or deletion at any time.
Responsible disclosure
Found something? Write to info@growthifye.com with steps to reproduce. We acknowledge within two business days and never take action against good-faith researchers.
See also our Privacy Policy.