Security

Every response is served with a strict Content-Security-Policy header that whitelists only trusted sources for scripts, styles, images, and connections. No inline scripts, no eval, no unsafe-inline. This blocks the entire class of cross-site scripting (XSS) attacks at the browser level, even if a developer accidentally introduces a vulnerable code path.

All pages are served with X-Globe-Options: DENYand a frame-ancestorsCSP directive that prevents the page from being embedded in any iframe. This eliminates clickjacking attacks where a malicious site overlays invisible buttons on top of a legitimate Theoretic Hotels screen.

Every API endpoint is rate-limited per IP and per token — 600 requests per minute for authenticated calls, 30 per minute for unauthenticated auth endpoints. Brute force on login, OTP, and password reset endpoints is blocked at the edge. Repeated violations trigger temporary IP bans and alert the security team.

Every request body is validated against a strict schema before it reaches business logic — types, lengths, formats (GSTIN, Aadhaar, phone, email, UUID), and enumerations (ID types, payment modes, room types). SQL injection is prevented by parameterised Prisma queries; no raw string concatenation anywhere in the codebase. Unknown fields are rejected, not silently ignored.

Four primary roles — Super Admin, Hotel Admin, Staff, Guest— each with granular permissions on every module and every action. Permissions are checked on every API call and every UI render; there is no client-trusted UI hiding. Multi-tenant isolation ensures a property's staff cannot read another property's data, ever.

Every meaningful action — booking created, payment captured, invoice generated, staff login, settings change, refund issued, GST slab edited — is logged with user, role, property, timestamp, IP, and before / after values. Logs are tamper-evident, retained for 12 months, and searchable by Hotel Admins and Super Admins for compliance and incident review.

All traffic is encrypted in transit with TLS 1.3. Sensitive fields at rest — guest ID numbers, staff passwords (bcrypt), API tokens, SMTP and WhatsApp credentials — are encrypted with AES-256 using keys rotated quarterly. Database backups are encrypted before they leave the primary region. Decryption keys are stored in a separate KMS, not in the application config.

Theoretic Hotels is built to comply with India's Digital Personal Data Protection (DPDP) Act, 2023. We act as a Processor on behalf of hotel properties (the Data Fiduciaries). Guest data is collected for explicit, lawful purposes; data principals can request access, correction, and erasure via the property. Data retention defaults are configurable per property; cross-border transfers are restricted to permitted jurisdictions.

Found a vulnerability? Email security@theoretichotels.comwith details and reproduction steps. We acknowledge within 24 hours, triage within 72, and ship a fix on a fastest-responsible timeline. We offer bounties (₹5,000–₹1,00,000 based on severity) for confirmed, previously unreported issues. Please don't test in production customer accounts; we'll provision a test tenant on request.