Security & RBAC
The Security module in the Admin Dashboard gives you live visibility into threats, active user sessions, and API-level data access. RBAC is enforced at the API level on every request across both dashboards.
Navigate to: Admin Dashboard > Security
Security Module Tabs
The Security page has three tabs. All three auto-refresh on a configurable interval (10 seconds, 30 seconds, 1 minute, or 5 minutes). A manual Refresh button is also available.
Security Alerts
A unified feed of all active security events, merged from three sources:
| Source | Examples |
|---|---|
| Threat | Detected attack patterns, malware signatures, known-bad actor fingerprints. |
| Violation | Policy violations: access to data outside permitted scope, DSR SLA breach, consent record tampered. |
| Alert | General warnings: failed logins above threshold, unusual request volume. |
| Suspicious IP | Requests from IP addresses flagged as proxies, Tor exit nodes, or repeat offenders. |
Filter alerts by source and severity. Toggle "Show resolved" to include closed alerts for historical review. Each alert has a severity: LOW, MEDIUM, HIGH, or CRITICAL.
Active Sessions
All currently active dashboard sessions across your team. For each session you can see the user, device type (desktop or mobile), browser, IP address, and session start time.
Two actions available: Revoke Session (ends one specific session immediately) and Revoke All Sessions (signs out all users except the currently logged-in admin). Use Revoke All Sessions if you suspect a credential leak.
Data Access
A log of every API call that accessed personal data, broken into two types:
| Type | Description |
|---|---|
| Public | Calls from the web SDK and public DSR/grievance forms. These come from end users and are unauthenticated. |
| Internal | Calls from authenticated dashboard sessions. Shows which operator or admin accessed which data and when. |
Each entry shows: HTTP method, endpoint, HTTP response status, data accessed (category), timestamp, IP address, and user email and role (for internal calls).
Role-Based Access Control
RBAC is enforced at the API level on every request. No frontend guard can be bypassed to access data above a user's role.
| Role | Dashboard | What they can do |
|---|---|---|
| ADMIN | Admin + Operator | Full access. Team management, billing, all modules, all settings. Can grant additional module access to operators. |
| DPO | Admin + Operator | Compliance oversight. Resolves escalated DSRs and grievances. Cannot change billing. |
| OPERATOR | Operator only | Processes DSR requests and grievances. Can escalate to DPO. Cannot access the Admin Dashboard by default. |
| AUDITOR | Operator only (read-only) | Views consent logs, DSR history, and audit trails. Cannot take any actions or make changes. |
Manage team members and roles from: Admin Dashboard > Team & Settings > Team Management
Data Encryption
In transit
TLS 1.2+ on all connections. Covers API calls, SDK communication, webhook delivery, and dashboard access.
At rest
AES-256 on all stored data including database backups.
Audit log integrity
Every audit log entry is SHA-256 hashed at write time. Any modification to a record is detectable by re-computing the hash.
Platform Security Controls
CSRF Protection
All state-mutating requests require a CSRF token. The token is validated server-side on every write operation.
Rate Limiting
API endpoints are rate-limited to prevent abuse and brute-force attacks.
Input Validation
All inputs are validated and sanitised server-side before processing.
Session Management
Sessions can be revoked individually or in bulk from the Security module. Active sessions are visible to admins in real time.
Data Residency
India-first infrastructure
All Privacy Labs data is stored in India by default, consistent with DPDP Act data localisation expectations.
Compliance & Certifications
Incident Response
For a breach affecting your users' personal data, the DPDP Act requires notification to the Data Protection Board of India within 6 hours. Use the Breach Management module (Admin > Legal > Breach Management) to log the incident, generate the report templates, and track the response timeline.
For a security incident affecting Privacy Labs itself (e.g. a vulnerability in our platform), contact founder@theprivacylabs.com. We follow responsible disclosure and will notify affected customers as required under the DPDP Act.