Security Policy

• Documented information-security programme owned by the leadership team and reviewed at least annually.
• Policies aligned with recognised frameworks including ISO/IEC 27001 and SOC 2 principles.
• Security responsibilities assigned across the organisation with defined incident escalation.

• Background verification for all employees prior to access provisioning.
• Annual mandatory security and privacy training for staff.
• Confidentiality obligations enforced through employment and contractor agreements.

• Role-based access control (RBAC) with least-privilege by default.
• Multi-factor authentication (MFA) required for all administrative access.
• Passwords stored using industry-standard salted, one-way hashing (bcrypt).
• Access reviews conducted on a periodic basis and on role change or termination.

• Encryption in transit using TLS 1.2 or higher for all external and administrative traffic.
• Encryption at rest for production databases and backups using AES-256 (or equivalent).
• Key management performed via managed cloud key services with restricted operator access.
• Data segregation between customer tenants enforced at the application and infrastructure layers.

• Secure software development lifecycle (SSDLC) with code review and static analysis on every change.
• Dependency and container-image scanning on the build pipeline.
• Regular vulnerability scanning and periodic third-party penetration testing.
• Defence-in-depth against the OWASP Top 10 including input validation, output encoding and CSRF/XSS mitigations.

• Deployment in hardened, network-isolated environments with default-deny firewall policies.
• Managed VPCs with dedicated subnets and security groups per service tier.
• DDoS protection at the ingress layer.
• Segregation of production from development and staging environments.

• Centralised, tamper-evident logging of authentication, administrative and application events.
• Continuous monitoring with automated alerting on anomalous behaviour.
• Log retention aligned to legal and contractual obligations.

• Documented incident-response plan with defined severity, triage and communication procedures.
• Customer notification of confirmed security incidents in accordance with the applicable contract and law.
• Post-incident review and remediation tracking.

• Automated encrypted backups of critical data with defined retention.
• Documented recovery-time and recovery-point objectives (RTO / RPO).
• Periodic testing of restore procedures.

• Due diligence performed on all sub-processors and critical vendors.
• Written data-processing agreements imposing equivalent security obligations.
• Ongoing monitoring of vendor security posture.

All production infrastructure runs on facilities operated by leading cloud providers, which maintain ISO 27001, SOC 2 and equivalent certifications for physical, environmental and personnel controls.

We welcome reports from independent security researchers. If you believe you have identified a vulnerability affecting the Services, please contact us via the contact page. We will acknowledge the report, investigate promptly and coordinate any disclosure.

This Security Policy is governed by the laws of India. Any dispute arising out of or in connection with this Policy shall be subject to the exclusive jurisdiction of the competent courts in Lucknow, India.