Your Data Protection is Our Top Priority
Bank-level encryption, 2FA authentication, and complete data isolation. We protect your photos and client information with the highest security standards.
Comprehensive Protection at Every Level
From authentication to data storage, every aspect of our platform is designed with security first.
Two-Factor Authentication
Protect your admin accounts with email-based OTP verification. Even if your password is compromised, your account stays secure.
- 6-digit OTP via email
- 10-minute validity window
- Optional per-admin setting
Automatic Account Lockout
Brute-force protection that automatically locks accounts after repeated failed login attempts.
- 5 failed attempts = 15 min lockout
- IP-based tracking
- Automatic unlock after cooldown
Intelligent Rate Limiting
Per-endpoint rate limiting prevents abuse and ensures fair usage for all users.
- Login: 10 requests/minute
- Checkout: 30 requests/minute
- Payments: 50 requests/minute
Password Security
Industry-standard password protection with bcrypt hashing and strength validation.
- Bcrypt hashing (cost factor 12)
- Minimum 8 characters required
- Strength validation on signup
CSRF Protection
Token-based Cross-Site Request Forgery protection on every form submission.
- Unique token per session
- Automatic validation
- Prevents unauthorized actions
SQL Injection Prevention
All database queries use PDO prepared statements, eliminating SQL injection vulnerabilities.
- PDO prepared statements
- Parameterized queries
- Input sanitization
Complete Multi-Tenant Security
Our architecture ensures that each studio operates in a completely isolated environment. Your data is never mixed with other studios.
Strict Studio ID Filtering
Every database query is filtered by studio ID, preventing any cross-studio data access.
Role-Based Access Control
Platform Admin vs Studio Admin permissions ensure users only access what they're authorized to.
Session Security
Sessions regenerate on login with secure cookie settings and automatic timeout.
Enterprise Security Headers
Industry-standard HTTP security headers protect against common web vulnerabilities.
X-Frame-Options
Prevents clickjacking attacks by blocking iframe embedding.
SAMEORIGIN Content-Security-Policy
Controls resource loading to prevent XSS attacks.
Strict Policy Strict-Transport-Security
Forces HTTPS connections for enhanced security.
HSTS Enabled X-Content-Type-Options
Prevents MIME type sniffing vulnerabilities.
nosniff Permissions-Policy
Controls browser feature access for privacy.
Restricted Referrer-Policy
Controls how much referrer information is shared.
strict-origin Secure Payment Processing
We partner with industry-leading payment processors to ensure your transactions are completely secure.
Backup & Data Retention
Your data is safe with automated backups and configurable retention policies.
Automated Daily Backups
Your database is automatically backed up every day with point-in-time recovery options.
Configurable Retention
Set custom data retention periods per event. Automatic cleanup respects your storage quotas.
Safe Deletion
Events with incomplete orders are protected from automatic deletion. Safety checks prevent data loss.
GDPR Compliance
Right to deletion, data portability, and transparent handling. We respect your data rights.
Security FAQs
Common questions about our security measures.
Is my data safe on MyPhotoStudio?
Yes. We use bank-level encryption (AES-256), secure password hashing (bcrypt), and complete data isolation between studios. Your data is never shared with third parties.
What is Two-Factor Authentication (2FA)?
2FA adds an extra layer of security by requiring a one-time password (OTP) sent to your email in addition to your password. This protects your account even if your password is compromised.
How is my payment information protected?
We never store your payment card details. All payments are processed through PCI-DSS compliant gateways like Razorpay and Stripe with secure webhook verification.
What happens if someone tries to hack my account?
Our system automatically locks accounts after 5 failed login attempts for 15 minutes. We also enforce rate limiting to prevent brute-force attacks and send alerts for suspicious activity.
Is my studio data isolated from other studios?
Absolutely. Our multi-tenant architecture ensures complete data isolation. Each studio operates in its own secure environment with strict access controls.
Are you GDPR compliant?
Yes. We follow GDPR principles with configurable data retention policies, right to deletion, and transparent data handling practices.
Your Security is Our Commitment
Join thousands of photographers who trust MyPhotoStudio with their business.