Security Architecture & System Safeguards
This document outlines the technical security controls implemented across the PharmaPulse ERP platform. Every control listed here is grounded directly in our verified production codebase and operating environment. We believe in complete transparency rather than unverified marketing buzzwords.
1. Network & Transmission Security
HTTPS / TLS Encryption
All communications between your pharmacy counter, browser client, mobile scanner, and PharmaPulse servers are encrypted in transit using industry-standard TLS (Transport Layer Security) with modern cipher suites. Plaintext HTTP traffic is automatically upgraded or rejected.
Dual Offline Resilience
PharmaPulse is designed with a hybrid local-and-cloud architecture. During internet service disruptions, counter billing and barcode scanning operate on an isolated local database. Upon reconnection, records synchronize via authenticated, encrypted API channels.
2. Authentication & Credential Security
Cryptographic Password Hashing
Pharmacist passwords are never stored in plaintext. They are protected using cryptographic PBKDF2/SHA-256 password hashing with unique, cryptographically random per-user salt values to defend against precomputed rainbow table attacks.
Multi-Factor OTP Verification
Logins and account registrations support secondary verification via time-limited, 6-digit One-Time Passcodes (OTP) dispatched through authenticated business SMTP channels and transactional SMS gateways.
HttpOnly Session Cookies
Authentication sessions issue high-entropy 64-character hexadecimal session tokens stored in cookies with HttpOnly; SameSite=Strict; Secure attributes, preventing token extraction via Cross-Site Scripting (XSS).
Hardware Device Binding
High-privilege counter sessions are cryptographically coupled with verified client device hardware identifiers, restricting sensitive transactions to authorized physical pharmacy POS terminals.
3. Defensive Rate Limiting & Abuse Prevention
To prevent brute-force credential stuffing and unauthorized automated access, PharmaPulse enforces automated rate limits at the HTTP layer:
- Login Rate Limiting: Enforces exponential backoff and temporary cooldowns upon repeated failed login attempts from a given IP address.
- OTP Flooding Defense: Limits OTP generation and verification attempts (maximum 15 verify events per 15-minute window) to prevent automated guessing.
- System File Protection: Direct HTTP access to database files (
smart_pharmacy.db), environment secrets (.env), version control directories (.git), and server source files (server.py) is strictly blocked with HTTP 403 Forbidden enforcement.
4. Data Isolation & Backup Operations
Branch & Store Partitioning
Every database query verifies authenticated user session and branch ownership. Store inventory, customer ledgers, and Udhaar records are logically partitioned, ensuring that one pharmacy cannot query or access another pharmacy's confidential records.
Automated Verified Backups
System operational state and databases undergo automated daily ZIP backups with SHA-256 cryptographic checksums and internal archive integrity testing (`testzip`) to verify zero archive corruption prior to secure off-site mirroring.
5. Audit Logging & Traceability
PharmaPulse maintains an internal, immutable audit trail (`audit_logs`) tracking administrative operations, including:
- Successful and failed authentication attempts with client IP address and timestamp.
- User role assignments, permission modifications, and cashier onboarding.
- Manual sales return authorizations and bill cancellations.
- Database backup downloads and license tier activations.
6. Vulnerability Disclosure & Security Contact
We welcome responsible security research and vulnerability reports from the developer and cybersecurity community:
Email: security@pharmapulseindia.com (or support@pharmapulseindia.com)
Phone / WhatsApp: +91 9810529871
Turnaround: Security inquiries and vulnerability submissions are triaged within 24 hours.