Security is a feature, not a footnote.

We treat your data the way we'd want a library to treat ours: carefully, minimally, and with respect. Security is built into how we design features, not bolted on at the end.

• In transit: TLS 1.2+ on every connection between app, website, and servers.
• At rest: AES-256 encryption on databases and backups.
• Secrets: Stored in managed secret vaults, never in code or logs.

• Passwords hashed with modern algorithms (bcrypt / argon2 family). We never see your password in plain text.
• Short-lived session tokens with automatic rotation.
• Role-based access control — students can never see another library's data, and owners can only see their own students.
• Internal admin access is gated, logged, and reviewed.

We run on enterprise-grade managed infrastructure with hardened defaults, automated patching, isolated environments for production and development, and daily encrypted backups with point-in-time recovery.

If something goes wrong — even something small — we follow a written runbook: detect, contain, eradicate, recover, learn. If a security incident affects your data, we will notify affected users within 72 hours of confirmation, with a clear description of what happened, what we did, and what you should do.

Found a vulnerability? Thank you. Please email techsupport@mylibraryapp.in with steps to reproduce. We commit to:

• Acknowledge your report within 48 hours.
• Keep you updated through investigation and fix.
• Credit you publicly (if you wish) once the issue is resolved.
• Never pursue legal action against good-faith researchers.

Continuous monitoring on application, infrastructure, and authentication layers. Anomalies trigger alerts. We perform internal code review on every change touching authentication, billing, or personal data.

• Use a unique, strong password.
• Don't share your library code publicly.
• Log out of shared devices.
• Report anything that looks off — we'd rather investigate ten false alarms than miss one real issue.