Security at Sukon
How we protect your account and data, and how to report a security issue.
Encrypted everywhere
All traffic uses HTTPS (TLS 1.2 or higher). Stored data is encrypted at rest.
No passwords to steal
You sign in with a one-time code sent to your email. Codes expire in 10 minutes and are limited in number.
Least access
Only the staff who need it can see account or request data, and access is logged.
Verified email
Our emails are signed with DKIM and protected by SPF and DMARC on sukon.in.
Payments
Card and bank details will never touch Sukon’s servers — they stay with an RBI-authorised payment partner.
Fraud warning
Sukon never asks for codes, passwords or payments by phone, chat apps or social media.
Found a security issue?
Email security@sukonapp.in with the steps to reproduce. Please do not access other people’s data, run denial-of-service tests or publish the issue before we fix it. We reply within 3 working days and thank researchers who help us.
How to report a vulnerability
- In scope: www.sukon.in, sukon.in and the Sukon API behind it.
- Out of scope: denial-of-service, spam or social-engineering tests, physical attacks, and third-party sites we link to.
- How: email security@sukonapp.in with the page, the steps to reproduce and what you could access. Our contact details are also in security.txt.
- What we do: reply within 3 working days, tell you how serious we think it is and when we expect to fix it, and let you know when it is fixed.
- Good faith: if you follow these rules, do not access or keep other people’s data and give us time to fix the issue, we will not take legal action against you.
What is in place today
- HTTPS only, TLS 1.2 or higher, with HSTS (preload, two years) on every page.
- A strict Content Security Policy, no third-party tracking scripts, and no advertising identifiers.
- Data stored in India (AWS Mumbai region), encrypted at rest; technical server logs deleted after 30 days.
- One-time email codes that expire in 10 minutes, with rate limits; admin passwords stored as salted PBKDF2 hashes with lock-out after 5 failed attempts.
Not done yet
An independent penetration test of the website and API, a recorded backup-restore exercise and a public status page are planned. We will publish the date, scope and result of each here when it is done — we do not claim them before that.