Security

Last updated: January 2024

1. Our Commitment to Security

At Coxa, security is foundational to everything we build. We understand that you trust us with your tasks, projects, team communications, and personal data. We take that trust seriously and are committed to implementing robust security measures to protect your information.

Our security practices are continuously reviewed and improved to address evolving threats. This page outlines our security measures and your role in maintaining account security.

2. Data Encryption

2.1 Encryption in Transit

All data transmitted between your device and Coxa servers is encrypted using industry-standard TLS (Transport Layer Security). Specifically:

• All connections to coxa.web.id are served exclusively over HTTPS — HTTP connections are automatically redirected to HTTPS
• We enforce TLS 1.2 at minimum, with TLS 1.3 preferred where supported by client browsers
• We implement HTTP Strict Transport Security (HSTS) to ensure browsers only connect over HTTPS
• Our SSL/TLS certificates are issued by a trusted Certificate Authority and are regularly renewed
• We use modern cipher suites and disable deprecated protocols (SSLv2, SSLv3, TLS 1.0, TLS 1.1)

2.2 Encryption at Rest

Your data is encrypted when stored on our infrastructure:

• Database contents are encrypted using AES-256 encryption at rest
• File uploads and attachments are stored with server-side encryption
• Backups are encrypted using AES-256 before being stored
• Encryption keys are managed through secure key management services with rotating credentials

2.3 Password Hashing

User passwords are never stored in plain text. We use bcrypt, a computationally intensive hashing algorithm specifically designed for password storage:

• Every password is salted with a unique, randomly generated salt before hashing
• Bcrypt’s work factor (cost) is regularly reviewed and increased as hardware improves
• Neither Coxa employees nor any automated system can read your plain-text password

3. Authentication Security

3.1 Password Requirements

To help you maintain a secure account, we enforce the following password requirements during registration and password changes:

• Minimum 8 characters in length
• We recommend using a combination of uppercase and lowercase letters, numbers, and special characters
• We check passwords against known compromised password databases and reject commonly used or breached passwords
• We display a password strength meter during account creation to encourage strong password choices

3.2 Brute Force Protection

We implement multiple layers of protection against automated password-guessing attacks:

• Rate limiting: After a threshold of failed login attempts from the same IP address or targeting the same account, further attempts are temporarily blocked with an exponential backoff
• Account lockout: After repeated failed attempts on a specific account, the account is temporarily locked and the user is notified via email
• CAPTCHA: After multiple failed attempts, a CAPTCHA challenge is required to proceed

3.3 Session Management

We manage user sessions securely:

• Session cookies are set with the Secure flag (only transmitted over HTTPS)
• Session cookies are set with the HttpOnly flag (inaccessible to client-side scripts, preventing XSS-based session theft)
• Session cookies are set with the SameSite attribute to protect against CSRF attacks
• Sessions automatically expire after a period of inactivity (idle timeout)
• Users can view and revoke active sessions from Account Settings

3.4 Two-Factor Authentication (2FA)

We offer optional two-factor authentication (2FA) for an additional layer of account security:

• 2FA can be enabled via TOTP (Time-based One-Time Password) authenticator apps such as Google Authenticator, Authy, or Microsoft Authenticator
• Recovery codes are provided when 2FA is enabled — users are advised to store these securely
• We highly recommend enabling 2FA, especially for team administrators and account owners
• Email notifications are sent when 2FA settings are changed

4. Infrastructure Security

4.1 Cloud Hosting

Our infrastructure is hosted on secure, enterprise-grade cloud platforms that maintain industry-leading physical and network security certifications. Key protections include:

• Data centers with 24/7 physical security, biometric access controls, and video surveillance
• Redundant power, network connectivity, and environmental controls
• Compliance with SOC 2, ISO 27001, and other internationally recognized security standards

4.2 Security Patches

We maintain a rigorous patch management process:

• Operating system and application security patches are applied regularly and on a defined schedule
• Critical security patches are applied as soon as they become available, outside the regular cycle
• We monitor security advisories for all third-party dependencies and libraries used in our platform
• Automated dependency scanning identifies known vulnerabilities in our software supply chain

4.3 Firewall & Network Protection

We use multiple layers of protection at the network level:

• Web Application Firewall (WAF) to filter and monitor HTTP traffic, blocking common attacks (SQL injection, XSS, etc.)
• Strict firewall rules limiting access to only necessary services and ports
• Network segmentation separating public-facing services from internal infrastructure
• Virtual Private Cloud (VPC) with private subnets for sensitive systems such as databases

4.4 DDoS Mitigation

We implement DDoS (Distributed Denial of Service) protection measures, including traffic monitoring, rate limiting at multiple layers, and automatic scaling to absorb and mitigate volumetric attacks.

5. Monitoring & Response

5.1 24/7 Security Monitoring

We continuously monitor our infrastructure and application for security events:

• Automated systems monitor server logs, application logs, and network traffic for anomalies
• Alerts are generated and escalated to on-call personnel for immediate investigation
• We log authentication events, administrative actions, and data access for audit purposes

5.2 Suspicious Activity Detection

Coxa employs automated systems to detect potentially suspicious activity on user accounts, including:

• Login attempts from new or unusual geographic locations
• Login attempts from new devices or browsers
• Multiple rapid password reset requests
• Unusual data access or export patterns

When suspicious activity is detected, we take immediate protective action — which may include temporarily locking the affected account — and send an email alert to the account owner via Amazon SES informing them of the event and the steps taken.

5.3 Vulnerability Scanning

We conduct regular security assessments:

• Automated vulnerability scanning of our infrastructure and application on a regular schedule
• Dependency scanning to identify known vulnerabilities in third-party libraries
• Periodic penetration testing to identify and address potential weaknesses

6. Data Privacy

Our approach to data privacy is security-first:

• Secure facilities: All data is stored in secure, access-controlled cloud environments
• Limited access: Access to production systems and user data is strictly limited to authorized personnel who require it for their role. Access is granted on a need-to-know basis and follows the principle of least privilege.
• Access auditing: All access to production data is logged and regularly reviewed. Unauthorized access attempts trigger immediate alerts.
• Access revocation: Employee access to production systems is promptly revoked upon role change or departure
• Data minimization: We collect and retain only the data necessary to provide and improve the Service

For more detail on how we handle your personal data, please refer to our Privacy Policy.

7. User Responsibilities

Security is a shared responsibility. You play a critical role in keeping your account and data secure:

• Use a strong, unique password: Do not reuse passwords across multiple services. Consider using a password manager.
• Enable two-factor authentication: 2FA significantly reduces the risk of unauthorized access, even if your password is compromised
• Keep your email secure: Your email account is the gateway to password resets and security alerts. Secure it with a strong password and 2FA.
• Review active sessions: Periodically check your active sessions in Account Settings and revoke any you do not recognize
• Be alert to phishing: Coxa will never ask you to provide your password via email. Be cautious of emails claiming to be from Coxa that direct you to unofficial websites.
• Report suspicious activity: If you notice unusual activity on your account or receive a suspicious email, contact us immediately
• Keep your devices and software updated: Use up-to-date operating systems, browsers, and antivirus software

8. Reporting Security Issues

If you discover a security vulnerability in Coxa, we encourage you to report it to us responsibly. We are committed to addressing legitimate security issues promptly.

• Email: security@coxa.web.id

When reporting, please include:

• A detailed description of the vulnerability
• Steps to reproduce the issue
• Any relevant information that would help us understand and resolve the issue

We request that you do not publicly disclose the vulnerability until we have had an opportunity to investigate and address it. We aim to acknowledge all reports within 48 hours and provide a timeline for resolution.

We do not currently operate a formal bug bounty program, but we greatly appreciate and acknowledge responsible disclosure.

9. Compliance

We follow industry best practices for data protection and email communication. Our practices are designed to comply with:

• AWS Simple Email Service (SES) acceptable use policies and sending requirements
• Applicable data protection and privacy regulations
• Industry-standard security frameworks (OWASP Top 10, CIS Benchmarks)
• Best practices for secure software development lifecycle (SSDLC)

We continuously review and update our security practices to maintain compliance and address new requirements as they emerge.