Security

We take security seriously. Here is an overview of how we protect your data and the Platform.

Encryption

All data transmitted between your browser and our servers is encrypted using TLS 1.3. Data at rest is encrypted using AES-256 encryption. Passwords are stored as bcrypt hashes and never in plaintext.

Infrastructure

The Platform is hosted on infrastructure providers with SOC 2 Type II certification. We use managed databases with automated backups, network isolation, and intrusion detection.

Access Controls

Internal access to user data is restricted to authorised personnel on a need-to-know basis. All access is logged and audited. Multi-factor authentication is required for all administrative access.

Vulnerability Management

We conduct regular security reviews and dependency audits. Critical vulnerabilities are patched promptly. We welcome responsible disclosure of security issues via our Contact page.

Data Minimisation

We collect the minimum data necessary to operate the Platform. We do not store Aadhaar numbers, PAN numbers, bank account details, or other sensitive government-issued identifiers. Payment processing is handled entirely by our PCI-DSS compliant payment provider.

Monitoring

Automated monitoring detects and alerts on suspicious activity, unauthorised access attempts, and system anomalies. Our team reviews security alerts and responds according to our incident response procedures.

Reporting a Vulnerability

If you discover a security vulnerability, please report it through our Contact page. Include a description of the vulnerability, steps to reproduce, and any potential impact. We will review and investigate all valid reports.