Secure sign-in and 2FA
Account access requires authentication. You can also enable TOTP two-factor authentication with an authenticator app; once enabled, sign-in also requires a current one-time code.
Your data is protected. You remain in control.
EZINDRA combines account protection, access controls, browser safeguards and secured public operations to reduce the risk of unauthorised access and abuse.
Encrypted connection
Communication with the production version of EZINDRA is protected with HTTPS/TLS, and production responses also use HSTS and browser security headers.
Separated account data
Access controls and user/workspace verification restrict operations to the appropriate authenticated account.
Private files
Logos, signatures, stamps and documents are stored in resources with restricted access and are exposed only through authorised operations.
Abuse protection
Selected public and sensitive operations are protected server-side with measures such as request rate limits, input validation and Cloudflare Turnstile anti-bot protection where it is used.
Secure quote sharing
A quote link uses a random token, is resolved from its server-side hash and expires after 24 hours. An Accept/Reject decision applies only to the specific unchanged document version.
Secure payments
Checkout and card details are handled by Paddle. Card details are entered in Paddle’s interface — EZINDRA does not store full payment-card details.
Control over your data
From account settings you can download a copy of your data and start the permanent deletion of your account and associated data.
How we protect your data
Security is implemented in layers — from sessions and 2FA through HTTP safeguards and access controls to abuse prevention and secured public links.
- Authentication, protected sessions and optional TOTP 2FA
- HTTPS/TLS and HSTS in production
- Content Security Policy and browser security headers
- Access controls for data and private files
- Server-side rate limiting and validation for sensitive operations
- Anti-bot protection in selected flows
- Expiring, non-cached links tied to a specific quote version
- Other sessions are revoked after a password change
Infrastructure and service providers
EZINDRA uses cloud services required for authentication, data storage, file handling, payments and application operation. The scope of processing and the list of providers are described in the Privacy Policy and Subprocessors list.
Security reports
If you identify an issue that may affect EZINDRA or user data, contact us through the contact form and select “Security”. Do not send passwords, verification codes or complete payment details.