Security and Responsible Disclosure

Libolink is a digital platform managed by Akhilesh Nigam.

How we protect data

• All traffic uses HTTPS.
• Each library's data is kept separate by database access rules. Staff see only what the owner allows.
• Platform administrators must use two-step verification (an authenticator app). When they open a library's workspace for setup or support, the access lasts at most 8 hours and every entry and change is written to that library's audit log.
• Uploaded files are scanned for malware, and image files are re-encoded.
• Important actions are written to an audit log: approvals, exports, permission changes and imports.
• Data is backed up regularly.
• Payment card and UPI details for online payments are handled by Razorpay; Libolink never sees card numbers.

Reporting a vulnerability

• Email info@libolink.com with the details and steps to reproduce. Please give us reasonable time to fix the issue before you disclose it publicly.
• Do not access, change or delete data that is not yours. Do not disrupt the service. Test only with your own accounts.
• We acknowledge reports within 3 working days and keep you updated. We do not take legal action against good-faith research that follows these rules.