Security
Government-grade protection
Security you can verify
WeOne carries citizen identity and government communication, so security is a design constraint of every module rather than a feature of one.
Authentication
- Mobile one-time passwords, hashed and single-use
- Optional two-factor authentication
- Automatic lockout after repeated failures
- Register of every device that signs in
Authorisation
- Role-based access control across the platform
- Per-action permission checks in the admin portal
- Jurisdiction-scoped access for officials
- Policy enforcement on the server, never the browser
Accountability
- Immutable audit log of administrative actions
- Actor, timestamp, IP address and changed values
- Severity classification for security events
- Moderation decisions recorded and appealable
Application hardening
- CSRF protection on every state-changing request
- Output escaping against cross-site scripting
- Parameterised queries against SQL injection
- Rate limiting on login, OTP, search and API
Data protection
- All data hosted in India on government infrastructure
- Encryption of sensitive fields at rest
- HTTPS enforced in production
- Strict validation of every uploaded file
Citizen control
- Per-field profile privacy
- Granular notification preferences
- Session and device revocation
- Account deactivation at any time
Responsible disclosure
If you find a vulnerability, report it privately to support@weone.kerala.gov.in before disclosing it publicly. We acknowledge reports within two working days and will credit researchers who follow this process.
Report a security issue