Security as architecture, not a badge.
SwitchX doesn't display certifications or regulatory approvals it doesn't hold. Here is how the platform is built.
bcrypt passwords, short-lived httpOnly session cookies, server-side permission checks on every endpoint.
TOTP authenticator codes are required for every privileged console role.
TLS in transit. Webhook signing secrets and sensitive identifiers are encrypted at rest at field level.
Secrets live in server-side environment configuration and are never returned to the browser.
Seven roles, with institution-level data isolation enforced in queries.
Append-only audit events with actor, action, resource and correlation ID. Secrets are redacted.
Per-user sandbox limits, per-IP enquiry limits and login lockout after repeated failures.
Input validation at every boundary, typed errors, no stack traces in responses.
Alert workflow with acknowledge, assign, investigate and resolve, all audited.
Database backups and restore drills are a deployment responsibility, documented in the README.
UPI PINs, OTPs and bank passwords are never collected or stored. Demo data is synthetic.
API latency percentiles, error rates, partner health and reconciliation exceptions.