Security Policy

• Our systems are hosted on secure and compliant cloud platforms (AWS, Azure, or Google Cloud) for scalability, monitoring, and resilience.
• DDoS protection is enabled through AWS Shield, Azure DDoS Protection, or Google Cloud Armor.
• We use Infrastructure-as-Code (IaC) tools like Terraform and CloudFormation for reliable, version-controlled deployments.

• Networks are segmented for development, staging, and production to reduce blast radius in case of a breach.
• WAFs filter edge traffic to block SQL injections, XSS, and other attacks.
• Firewalls and antivirus tools are continuously running to detect and block malicious activity.

• Access is granted strictly on a role-based basis (RBAC), with permissions limited to what is necessary.
• Multi-Factor Authentication (MFA) is enforced for cloud and admin tool access.
• Strict access controls ensure only authorized personnel access user data.

• All data is encrypted using TLS in transit and AES-256 at rest.
• Backups are encrypted and securely stored for recovery purposes.
• Only necessary data is collected, and we never share or sell it without consent or legal requirement.
• Users have the right to request access, correction, or deletion of their personal data at any time.

• Payments are handled by secure gateways like Razorpay, Stripe, and Paytm using SSL/TLS encryption.
• No card details are stored on our servers to avoid potential breaches.
• Two-factor authentication may be required for added transaction security.
• Customers receive instant confirmation via email, SMS, or push notification.
• Refunds follow the same secure channels with tracking and verification.
• High-risk transactions are flagged for manual verification to prevent fraud.

• System activity is continuously monitored via tools like AWS CloudTrail, Azure Monitor, and SIEMs.
• Intrusion Detection Systems (IDS) and log collection help identify threats and breaches.
• Our security dashboards provide real-time visibility into system health and incidents.
• Automatic alerts notify teams of suspicious activity such as hacking attempts or service crashes.

• Regular patching, vulnerability scans, and malware checks keep systems secure.
• Threat intelligence updates allow us to stay ahead of evolving cyber threats.
• Security audits are conducted routinely to validate and strengthen defenses.

• A detailed incident response plan is in place to respond, contain, and report security issues swiftly.
• Audit logs and alert reviews are used to continuously improve threat detection and response strategies.

We adhere to all applicable data protection laws including the Indian IT Act and GDPR for global users.