Account Security & Governance
Exovon enforces enterprise-grade identity controls, passwordless authentication, and full compliance with Indian cybersecurity regulations (CERT-In Directions) and data privacy laws (DPDP Act 2023). Manage teams, provision API tokens, and audit user sessions securely.
Passwordless Identity
One-click Google OAuth and cryptographic Magic Links eliminate credential stuffing and database password breaches.
CERT-In Audit Logging
Mandatory onboarding IP, country, device user-agent, and session timestamps stored securely for Indian regulatory compliance.
Team Workspaces
Invite engineers with granular roles (Owner, Admin, Developer, Viewer) to prevent accidental infrastructure deletion.
1. Authentication & Session Tracking
Exovon accounts use passwordless authentication. When you sign in via Google OAuth or Magic Link, the platform issues an ephemeral, cryptographically signed JSON Web Token (JWT):
Automated Workspace Provisioning
First-time authentication immediately initializes your private workspace, provisions Hobby tier quotas, and creates your default region in Mumbai (asia-south1).
Session Fingerprinting (CERT-In Direction 2(v))
Per Indian cybersecurity mandates, Exovon records signup IP, country, device user-agent, and login timestamps in encrypted metadata stores.
Session Expiration & Multi-Device Logout
Authentication sessions expire after 14 days of inactivity. You can click "Revoke All Sessions" in Account Settings to terminate active tokens across all devices simultaneously.
2. Role-Based Access Control (RBAC)
Collaborate securely with team members without sharing master account credentials. Assign appropriate roles when inviting users:
| Role | Deploy & Rollback | Manage Env Vars & Secrets | Database Operations | Billing & Teardown |
|---|---|---|---|---|
| Owner | ✓ Full | ✓ Full | ✓ Full | ✓ Full |
| Administrator | ✓ Full | ✓ Full | ✓ Full | ✗ Restricted |
| Developer | ✓ Full | View Masked Only | ✓ Query / Migrate | ✗ Restricted |
| Viewer | ✗ Read-Only | ✗ Read-Only | ✗ Read-Only | ✗ Restricted |
3. Account Deletion & DPDP Erasure Rights
Under Section 12 of India's Digital Personal Data Protection (DPDP) Act 2023, you have the right to erase your personal data. When you initiate account deletion from Account Settings → Danger Zone:
Cascading Instant Erasure
- All application source code & build artifacts destroyed
- ExoStore PostgreSQL databases dropped permanently
- Custom domains unmapped and SSL certificates revoked
- Environment variables & API keys wiped from Secret Manager
5-Year Compliance Tombstone
Per CERT-In Direction 2(v) and DPDP Act Section 8(7), non-identifying subscriber transaction records (onboarding IP, timestamp, email hash) are locked in an immutable compliance archive (compliance_subscriber_archive) for exactly 5 years, after which they are purged automatically.
4. Enterprise Security & Cloud Shared Responsibility
Exovon secures client workloads through defense-in-depth and the Google Cloud Platform Shared Responsibility Model:
Physical Infrastructure & Cloud Security Controls
Compute containers and build systems run in Google Cloud Mumbai (asia-south1), while managed PostgreSQL databases execute in Singapore (aws-ap-southeast-1 via Neon). Workloads benefit from the underlying cloud provider data centers' certified physical security, hardware root-of-trust, and audited SOC 1, SOC 2 Type II, ISO/IEC 27001, and PCI-DSS Level 1 protections.
Enterprise SSO & Directory Sync (SAML 2.0 / OIDC)
For teams requiring centralized identity management, Exovon supports enterprise SSO federation with Okta, Microsoft Entra ID (Azure AD), and Google Workspace on Custom plans. Contact enterprise@exovon.in to initiate IdP federation.
Frequently Asked Questions
How can I transfer ownership of a project to another user?
Project owners can navigate to Project Settings -> General -> Transfer Ownership, enter the email address of the recipient, and confirm the transfer with a verification code.
Can I contact Exovon's Data Protection / Grievance Officer?
Yes. Under the IT Rules 2021 and DPDP Act 2023, our Resident Grievance Officer is Ayan Khan (Founder, grievance@exovon.in, Pune, Maharashtra).