Data Safety & Privacy
Our commitment to enterprise-grade data security, photo proxy protection, and encrypted identity verification.
1. Data Protection Protocol
At **iCard Software**, we treat organizational member data with strict confidentiality. All student, employee, and visitor records are isolated within tenant-scoped database architectures and accessed exclusively through role-based access controls (RBAC).
2. Authenticated Photo Proxy Storage
Member portrait photos are stored in private, unlisted application storage disks (`storage/app/private/member_photos`).
- Photos are never publicly exposed or directly browseable via raw web URLs.
- Photo rendering is served dynamically through authenticated, signed proxy routes (`/members/{member}/photo`).
- Automatic web scrapers and unauthorized bots are strictly blocked from harvesting member imagery.
3. Dynamic QR Code Security & Encryption
QR codes printed on ID cards contain high-entropy, 64-character cryptographic tokens (`verification_token`) rather than raw database primary keys.
- Scanning a QR code directs security officers to a real-time verification portal (`/verify/{token}`).
- Verification checks do not expose sensitive personal details like home address or private phone numbers to unauthorized scanners.
- All network traffic is encrypted using 256-bit SSL/TLS in transit.
4. Third-Party Subprocessors & Storage
We do not sell, rent, or monetize your organization data. Third-party subprocessors (such as AWS Cloud, Razorpay, Stripe, and Mailgun) are utilized solely for essential infrastructure hosting, payment handling, and transactional notifications under strict Data Processing Agreements (DPA).
5. Data Retention & Export
Organization owners retain complete control to export member records in CSV format or execute hard data purge requests upon account closure.