Security & compliance

Last updated: 10 November 2026

How ServeBooks protects your data.

OWASP Top 10 — Built and tested against the OWASP Top 10 (2021) web-application risks
WCAG 2.1 AA · Section 508 — Designed to the WCAG 2.1 AA accessibility standard used by US Section 508 and EN 301 549
DPDP Act · GDPR — Privacy by design: data separation, access and erasure on request, consent for optional cookies
CERT-In — Security logs kept 180 days, with timestamps on every event, and an incident-reporting process
AES-256 · TLS — Encrypted in transit (TLS) and at rest (AES-256-GCM for secrets and backups)
ISO 27001 aligned — Controls follow ISO/IEC 27001:2022 Annex A (access, logging, backup, cryptography, secure development)

Every organisation has its own address and its own sign-in accounts, and its data is kept separate.
Two-step sign-in, account lock-out after repeated wrong passwords, and permissions checked on every action.
Encrypted connections, encrypted backups, and a record of every change.