How Headx is built and secured

1 Executive summary

Headx Monitor is delivered in two forms: Cloud (SaaS), hosted on a server in a Mumbai, India data centre, and On-Premise, installed on the customer's own server so that no data leaves their network. The platform consists of a Windows endpoint agent written in C++, a Node.js / Express backend API, and a Laravel 12 administrative dashboard backed by PostgreSQL.

Security posture at a glance

2 System architecture overview

2.1 Trust zones

• Endpoint zone — Windows workstations running the Headx agent
• Network path — agent and browser traffic to Headx over HTTPS
• Headx Cloud zone — the Mumbai server: Apache (TLS termination), the Node.js API, the Laravel dashboard and PostgreSQL
• Sub-processors — payment gateways, which receive billing details only (see section 12)

2.2 Data flows

3 Deployment models

3.1 Cloud (SaaS) Mumbai, India

No production data is replicated outside India.

• A server in a Mumbai data centre runs the application, the PostgreSQL 17 database and screenshot storage
• The database accepts connections from the server itself only
• The database is backed up daily; backups stay in India
• Apache terminates TLS; sign-in, token refresh and agent enrolment are rate-limited

Tenant isolation: every backend request carries the company it belongs to, every database query is scoped by company_id, and stored screenshot paths begin with the company ID.

3.2 On-Premise Your server

Recommended for BFSI, healthcare, government, and any customer subject to strict data-residency requirements.

• The full application runs on a server you control
• All customer data stays on that server
• You manage encryption at rest and backups with your own tools

Headx engineers access On-Premise systems only when the customer grants access.

4 Identity & access management

4.1 Customer sign-in

• Password storage — bcrypt, salted per user
• Sessions — secure, HTTP-only cookies with SameSite=Lax; CSRF tokens on every change; sessions expire after 2 hours
• Sign-in protection — repeated sign-in attempts are rate-limited
• MFA — TOTP for customer accounts Q1 2027
• SSO — SAML 2.0 with Microsoft Entra ID and Okta Q1 2027

4.2 Role-based access control

Five built-in roles: Super Admin, IT Admin, HR Manager, Department Head and Read-only. Companies can also define custom roles with their own permissions.

4.3 Headx staff access

Headx staff administer the service through a separate platform console, which supports two-factor authentication (TOTP). Actions taken in the platform console are recorded in an audit log.

5 Data protection

5.1 In transit

• HTTPS with TLS 1.3 on customer-facing endpoints
• HSTS: max-age=31536000; includeSubDomains
• Agent traffic to the backend over HTTPS
• Dashboard-to-API and API-to-database traffic stays on the server (localhost)

5.2 At rest

• Passwords and agent API keys are stored only as bcrypt hashes
• Cloud: the database, screenshots and recordings are stored on the Mumbai server and never leave India
• On-Premise: data is protected by your own disk encryption and access controls

5.3 Secrets

• Database credentials and signing keys live in server-side environment files that are not served on the web
• Secrets are never sent to the browser or to the agent

6 Network security

• Apache reverse proxy — TLS termination and security headers: Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy
• Rate limiting — on sign-in, token refresh and agent enrolment
• Database — listens on localhost only

7 Endpoint agent security

Installer

• Delivered as an MSI for manual, Group Policy or Intune roll-out
• The installer is not yet code-signed, so Windows SmartScreen may show a warning on first run. SHA-256 hashes are available on request so IT teams can allow-list it; code signing is on the roadmap

Runtime & communication

• A Windows service running as LocalSystem, with a helper process in each signed-in user's session
• Tamper protection: the service restarts itself if stopped, its registry settings are locked against standard users, and uninstalling requires a password set in the dashboard
• Each agent authenticates with its own API key, issued at enrolment and stored hashed on the server
• Events are queued on the PC while it is offline and sent when the connection returns

Transparency

• A consent notice is shown on first run and the employee's response is recorded. Deployments that use stealth mode skip the notice, and the employer is then responsible for informing staff
• Administrators can pause collection, or stop it outside working hours

8 Application security

The backend has an automated test suite covering tenant isolation, authentication, billing and the agent API.

9 Threat model (STRIDE)

10 Compliance & standards

India statutory

• IT Act 2000 (and 2008 amendment) — Section 43A reasonable security practices
• IT Rules 2011 — consent, notice, retention, breach reporting
• DPDP Act 2023 — consent, data-principal rights, Grievance Officer see status

Sector frameworks (aligned)

• RBI Master Direction on Outsourcing of IT Services (Apr 2023); Cyber Security Framework for Banks (Jun 2016)
• IRDAI Information and Cyber Security Guidelines
• SEBI Cybersecurity and Cyber Resilience Framework

International standards

11 Incident response

Commitments

• Affected customers — notified within 72 hours of a confirmed incident involving their data
• CERT-In — within 6 hours, per the 28 April 2022 directive
• Data Protection Board of India — as required under the DPDP Act 2023
• Sector regulators — RBI / IRDAI / SEBI timelines honoured for relevant customers

12 Sub-processors

13 Audit logging

Administrative actions in the dashboard are recorded in an audit trail that the customer can review.

• Retention — 1 year by default; customers can change this
• Platform console — actions by Headx staff are logged separately

14 Backups & continuity

Cloud

• The database is backed up daily and the backups are kept in India
• The Cloud service runs in a single Mumbai data centre
• Uptime and recovery commitments, where offered, are set out in the customer's order form

On-Premise

The customer owns the backup strategy; Headx provides the documentation.

15 Reporting vulnerabilities

Report vulnerabilities to info@headx.in. We acknowledge every report, keep the reporter updated until the issue is fixed, and ask for reasonable time to fix it before public disclosure.

16 Data subject rights & deletion

Cloud cancellation: full export window 30 days; production deletion within 90 days; backup deletion within 180 days.

17 Security roadmap