Security & Trust
Security at CAMARON
We protect farm operations data the way banks protect transactions: encrypted in transit and at rest, locked down with row-level access controls, and continuously monitored. Below is exactly how.
Encryption
- TLS 1.3 for every request in transit
- AES-256 at rest (managed Postgres + storage)
- bcrypt password hashing
- Have-I-Been-Pwned check on signup & password change
Data residency
- India tenants: AWS ap-south-1 (Mumbai)
- EU tenants: eu-central-1 (Frankfurt) on request
- Data never leaves the selected region
- Daily automated backups, 7-day point-in-time recovery
Access controls
- Row-Level Security on every table
- Separate
user_rolestable — no client-side role checks - SECURITY DEFINER
has_role()avoids recursive RLS - Edge functions validate JWTs server-side
- 25-min idle session timeout, global 429 handler
Compliance posture
- SOC 2 Type II — roadmap (target Q3 2026)
- ISO 27001 — roadmap (target Q4 2026)
- GDPR-ready DPA on request
- DPIIT-recognized startup (DIPP10534)
API keys & secrets
- API keys hashed with SHA-256, never stored in plaintext
- Secrets injected via managed env, never committed to source
- Rate-limited per endpoint and per user tier
Vulnerability disclosure
Found a security issue? Email security@robicrufarm.com. We acknowledge within 5 business days, follow a 90-day coordinated disclosure window, and credit valid reports in our hall of fame.
Machine-readable contact: /.well-known/security.txt