Security & Trust Center
Built for Trust. Engineered for Security.
Every transaction, contract, and interaction on Ascendoria is protected by layered security controls — so freelancers, clients, and companies can work with confidence.
10 Critical Security Controls
The foundations that protect real money and real reputations.
Hosted Checkout
Active
Webhook Verification
Active
HTTPS Encryption
Active
RBAC (Role-Based Access)
Active
Backend Validation
Active
Transaction Ledger
Active
Idempotency
Active
Audit Logs
Active
Automated Backups
Active
Fraud Detection
Active
Account & Authentication
- Passwords are bcrypt-hashed by the platform — never stored in plain text.
- Email verification required before account activation.
- Secure session management with expiring tokens.
- Logout from all devices via session invalidation.
- Sensitive account data never exposed to the frontend.
- 2FA for admin accounts (roadmap — platform auth extension).Roadmap
Payment Security
- Hosted Checkout / Redirect Checkout via PayTabs — card data never touches our servers.
- No card numbers or CVV ever stored on the platform.
- HTTPS enforced on all pages.
- Payment confirmed via signed Webhook from the provider — return URL alone is NOT trusted.
- Backend verifies amount, currency, and transaction reference before activation.
- Idempotency: duplicate webhook callbacks cannot double-activate a service.
- Transaction states tracked: Pending → Paid → Failed → Refunded → Cancelled.
- Final price verified on the backend — frontend cannot tamper with pricing.
Freelancer Balances & Ledger
- Every financial movement creates a ledger entry (AscendCoinsLedger + PaymentTransaction).
- Users cannot edit their own balance from the frontend — backend-enforced.
- Each credit/debit has a unique Transaction ID.
- Reason recorded for every balance change.
- Negative balances prevented unless explicitly system-allowed.
- All financial operations logged to Admin Audit Log.
Withdrawals & Transfers
- Withdrawal account details verified before processing.
- Bank account details never exposed to other users.
- Minimum withdrawal threshold enforced.
- Manual review for large or suspicious withdrawals.
- User notified on withdrawal creation and every status change.
- Withdrawal states: Pending → Processing → Paid / Rejected / Cancelled.
- Withdrawal only marked 'completed' after actual transfer confirmation.
Backend & API Protection
- Role-Based Access Control (RBAC) via Row-Level Security on every entity.
- Every API call checks user permissions and ownership.
- NoSQL injection protection via parameterized SDK queries.
- XSS protection — user content rendered safely, no raw HTML injection.
- API Keys and Secret Keys stored in backend secrets — never in frontend code.
- All user input validated against entity schemas on the backend.
Administration & Fraud Prevention
- Admin Audit Log records every administrative action with actor, IP, device, and timestamp.
- Super Admin privileges isolated from regular admin access.
- IP and device/session tracking for sensitive admin operations.
- Alerts on abnormal activity patterns (SecurityScan + ErrorReport entities).
- Monitoring for suspicious multi-account creation.
- Large or unusual payments flagged for manual review.
- Accounts or transactions can be frozen pending investigation.
- Users cannot manipulate ad pricing or commission from the frontend.
Files & Data Protection
- Uploaded files scanned for type and size before storage.
- Allowed file types enforced; dangerous executables blocked.
- Sensitive files stored via private storage with signed access URLs.
- Automatic database backups managed by the platform.
- Data encrypted in transit (TLS/HTTPS) and at rest where required.
- Passwords and payment data never written to logs.
Disputes & Trust
- Dispute Center between client and freelancer (Dispute entity).
- Evidence and messages preserved and immutable once submitted.
- Timestamped event log for every project (ContractAuditLog).
- Clear refund and cancellation policy enforced via escrow lifecycle.
- Reporting system for users, projects, and companies (ContentReport + ModerationReport).
- Accounts with repeated reports flagged for moderator review.
Independent Security Review Recommended
Before launching with real transactions, Ascendoria recommends a professional Security Review and Penetration Test by a certified information-security specialist, plus verification of legal and payment-provider requirements in your operating jurisdiction.
