Security, GDPR & API Reference

1 Security

SehaCore is built with security at the core. We protect your data and our systems through technical and organisational measures so you can run your business with confidence.

1.1 Infrastructure and hosting

• Cloud hosting: We use reputable cloud providers with geographically distributed data centres, redundant power and networking, and environmental controls.
• Network security: Firewalls, intrusion detection, and DDoS mitigation help protect our perimeter. Traffic between you and our services is encrypted (TLS 1.2+).
• Availability: We aim for high availability through redundant components and monitoring. Planned maintenance is communicated in advance where possible.
• Backups: Data is backed up regularly with retention aligned to our data retention policy. Backups are stored securely and tested for restore capability.

1.2 Data protection

• Encryption in transit: All data between your browser or app and our servers is encrypted using TLS. We do not accept unencrypted connections for sensitive operations.
• Encryption at rest: Where supported by our infrastructure, data at rest is encrypted using industry-standard encryption (e.g. AES-256). Database and file storage use encryption keys managed securely.
• Passwords: Passwords are hashed using strong, one-way hashing (e.g. bcrypt or equivalent). We do not store plain-text passwords.
• Minimisation: We collect and retain only the data necessary for providing the Service, as described in our Privacy Policy.

1.3 Access control and monitoring

• Role-based access (RBAC): Within the application, users have access only to the modules and actions permitted by their role. You control roles and permissions for your workspace.
• Principle of least privilege: Our internal access to systems and data is restricted to personnel who need it for their job. Access is reviewed periodically and revoked when no longer required.
• Authentication: We support secure login with password and, where offered, two-factor authentication (2FA). We recommend enabling 2FA for admin accounts.
• Audit logging: Sensitive actions (e.g. login, permission changes, data export) may be logged for security and compliance. Logs are retained and protected from tampering.
• Vendor security: Third-party providers that process data on our behalf are evaluated for security and bound by contracts that require appropriate safeguards.

1.4 Incident response and compliance

We have procedures to detect, contain, and respond to security incidents. In the event of a breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and affected users in accordance with applicable law (e.g. within 72 hours where required by the GDPR). We will also take steps to mitigate harm and prevent recurrence.

If you become aware of a potential security issue (e.g. unauthorised access or a vulnerability), please report it to us at security@sehacore.com. We do not pursue legal action against researchers who report issues in good faith and follow responsible disclosure.

2 GDPR (General Data Protection Regulation)

For users in the European Economic Area (EEA), United Kingdom, and other jurisdictions with similar laws, we process personal data in line with the GDPR and related legislation. This section summarises our approach; our Privacy Policy contains the full details.

2.1 Principles and legal basis

• Lawfulness, fairness, transparency: We process personal data only where we have a legal basis (contract, legitimate interest, consent, or legal obligation) and explain our practices in our Privacy Policy.
• Purpose limitation: Data is collected for specified, explicit, and legitimate purposes and not further processed in a way incompatible with those purposes.
• Data minimisation: We collect only what is necessary for the purposes described.
• Accuracy: We take steps to keep data accurate and up to date; you can correct your data via your account or by contacting us.
• Storage limitation: Data is retained only as long as necessary (see our Privacy Policy and Data Retention section).
• Integrity and confidentiality: We implement appropriate technical and organisational measures to protect data (see Security above).
• Accountability: We document our processing and can demonstrate compliance when required.

Legal bases we rely on: performance of contract (providing the Service), legitimate interests (e.g. security, analytics, product improvement), consent (where we ask for it, e.g. marketing or non-essential cookies), and legal obligation (e.g. tax, anti-fraud).

2.2 Your rights under the GDPR

You have the right to:

• Access: Obtain confirmation as to whether we process your data and a copy of that data.
• Rectification: Have inaccurate or incomplete data corrected.
• Erasure (“right to be forgotten”): Request deletion of your data, subject to legal exceptions (e.g. we may need to retain some data for legal or contractual reasons).
• Restriction of processing: Request that we limit how we process your data in certain circumstances.
• Data portability: Receive your data in a structured, commonly used, machine-readable format and, where technically feasible, have it transmitted to another controller.
• Object: Object to processing based on legitimate interests or to direct marketing. We will cease such processing unless we have compelling legitimate grounds that override your interests.
• Withdraw consent: Where processing is based on consent, you may withdraw it at any time.
• Lodge a complaint: Complain to a supervisory authority in your country (e.g. in the UK, the ICO; in the EEA, your local data protection authority).

To exercise any of these rights, contact us at privacy@sehacore.com or use the details in our Privacy Policy. We will respond within the time required by law (typically one month) and may need to verify your identity.

2.3 Data Protection Officer and international transfers

Data Protection Officer (DPO): For questions about our processing of personal data or to exercise your rights, you can contact our privacy team at privacy@sehacore.com. If we designate a formal DPO, their contact details will be published here and in our Privacy Policy.

International transfers: Your data may be processed in countries outside the EEA/UK. We ensure appropriate safeguards (e.g. standard contractual clauses approved by the European Commission or UK authorities, or other mechanisms permitted by law) so that your data receives an adequate level of protection. Details can be provided on request.

3 API Reference

The SehaCore API lets you integrate your applications with SehaCore to read and write data (e.g. products, sales, inventory) programmatically. All API access is over HTTPS. This section describes authentication, base URL, common endpoints, and usage limits.

3.1 Authentication

API requests must be authenticated. We support:

• Bearer token (OAuth 2.0 or API token): Include the token in the Authorization header:

• API key (if enabled): Some endpoints may accept an API key in the header or query parameter, as indicated in the dashboard or developer docs.

Obtain tokens or API keys from your SehaCore account under Settings → Integrations → API (or the equivalent path in your workspace). Keep credentials secret and do not expose them in client-side code or public repositories.

3.2 Base URL and endpoints

Base URL: API requests are sent to your instance base URL, for example:

Replace your-domain with your workspace subdomain or the host provided in your account. The path may include a version prefix (e.g. /api/v1). Check the in-app API or developer section for your exact base URL.

Common endpoints (reference)

Below is a representative list. Actual paths and parameters may vary; always refer to the latest in-app API documentation or OpenAPI/Swagger spec if provided.

Request and response format

Requests should send Content-Type: application/json when including a body. Responses are typically JSON with a structure such as:

For list endpoints, data may be an object with items (array) and meta (pagination: total, current_page, per_page).

3.3 Errors, rate limits, and versioning

HTTP status codes

• 200 – Success (GET, PUT, PATCH).
• 201 – Created (POST).
• 400 – Bad request (invalid parameters or body).
• 401 – Unauthorised (missing or invalid token).
• 403 – Forbidden (insufficient permissions).
• 404 – Resource not found.
• 422 – Unprocessable entity (validation errors).
• 429 – Too many requests (rate limit exceeded).
• 500 – Server error; retry with backoff.

Error response body

On error, the body may look like:

Rate limiting

To ensure fair use and stability, we apply rate limits (e.g. requests per minute per token or per IP). When exceeded, the API returns 429 Too Many Requests. Response headers may include X-RateLimit-Limit, X-RateLimit-Remaining, and Retry-After. Implement exponential backoff when you receive 429.

Versioning

We version the API (e.g. /api/v1). New versions may be introduced with notice; we will support previous versions for a reasonable period. Deprecation and migration details will be communicated via release notes or email to API users.

For the most up-to-date list of endpoints, parameters, and examples, use the API documentation available in your SehaCore workspace (Settings → API / Developer) or contact support@sehacore.com for developer access.