Open Journal Center
OPEN JOURNAL CENTEROJS Themes, Plugins & Services
Open Journal Center /Security

Legal Documents

Security Policy & Architecture

Last updated: November 1, 2026

At Open Journal Center ("OJC"), a digital venture by Indra Institute Research & Publication, maintaining the integrity, confidentiality of manuscript data, and operational reliability of your academic publishing workflow is our foremost priority. This page outlines our security standards, server hardening, and vulnerability protection mechanisms.

1. Infrastructure Hardening

  • Network Isolation: Our managed hosting servers run inside private virtual cloud environments (VPC) with granular firewall rule sets restricting extraneous port exposure.
  • DDoS & Web Application Firewall: Integrated cloud filtering mitigates volumetric layer 7 attacks, SQL injection attempts, and brute-force credential stuffing.
  • Operating Systems & Patches: Automated vulnerability scans and kernel live-patching safeguard our servers without service downtime.

2. Encryption Protocols

  • In-Transit: Strict Transport Security (HSTS) with TLS 1.3 encryption across all journal subdomains and public API endpoints.
  • At-Rest: Database volumes, asset directories, and disaster recovery snapshot backups are encrypted using AES-256 standards.
  • Credential Storage: Master credentials and user passwords employ Argon2id / bcrypt hashing with unique cryptographically secure salts.

3. Code Quality & Extension Audits

  • Every theme and plugin developed by OJC is analyzed through static application security testing (SAST) before publication.
  • We adhere strictly to PKP OJS secure programming guidelines, verifying CSRF token validation and strict input sanitization on all endpoints.
  • Third-party dependencies are continuously monitored against active CVE vulnerability registries.

4. Backups and Disaster Recovery

  • Automated daily database dumps and uploaded PDF manuscript archives.
  • Geographically isolated replication prevents permanent loss against local data center incidents.
  • Regular disaster recovery drills ensuring Recovery Point Objective (RPO) under 24 hours and Recovery Time Objective (RTO) under 2 hours.

5. Responsible Disclosure Program

If you believe you have discovered a vulnerability within our web platforms, themes, or managed OJS services:

  1. Notify us privately before public disclosure.
  2. Submit your findings and reproduction steps to openjournalcenter@gmail.com.
  3. We acknowledge vulnerability submissions within 48 business hours and provide status updates until full patch deployment.