Protect Your Data

Building a great app can be enormously satisfying - until someone steals the data you've collected for your company or a client. Having your app get hacked and data get stolen or corrupted can be a nightmare, for you and for your users. So what can you do to make sure that doesn't happen? 

There are multiple actions that you can take to protect sensitive data:

• Activate "SSL" (Secure Sockets Layer) protection if it's available to you. SSL (or its successor, Transport Layer Security) uses sophisticated encryption algorithms to scramble data in transit between a server and a user's browser or between two apps, preventing hackers from reading or copying the data as it's being transmitted.
• Force users to log in (at least to pages containing sensitive data). It may also be a good idea to enforce rules about how complex the user's password should be and to require changing the password periodically. 
• Consider automatically logging out users after a certain period of inactivity.
• Set up access rules for any page in your app that displays sensitive data. There are really three layers to this type of security:
• Mark those pages as private so that the app knows to restrict access.
• Set up "roles" for users so that only users with the proper role (administrator, manager, supervisor, etc.) can access a particular page that's marked as private.
• Assign "permissions" to users who do have access to a protected page (that is, whether a particular user can just view the page, or can view and edit data on the page, or view, edit, and delete data, and so on).
• Avoid using private API keys or tokens on a page in your app - restrict their use to workflows.
• If the platform you're on (and the plan you're on) provide the ability to encrypt and decrypt specific data fields, consider keeping fields containing sensitive data encrypted and only decrypt them when actually using those fields in the app.
• Avoid using third-party plugins to process sensitive data, unless the plugin is a standard add-on such as Stripe or MailChimp.
• Build in change logs or other ways to audit user additions, edits and deletions to sensitive data.