Platform Security Statement & Technical Safeguards
Verifiable technical security disclosures detailing TLS 1.3 transport encryption, Bcrypt credential hashing, PCI-DSS Level 1 payment isolation, RBAC JWT integrity, and CERT-In 6-hour incident reporting.
We use modern cryptographic standards to protect your data. All communication is encrypted via TLS 1.3. Passwords and OTPs are hashed using irreversible algorithms. Payment processing is isolated within PCI-DSS Level 1 certified vaults.
- ✓TLS 1.3 Everywhere: All API and WebSocket connections require modern transport encryption. HTTP is dropped.
- ✓Bcrypt & Salted Hashes: Passwords use Bcrypt (factor 10). OTPs are hashed with server-side peppers.
- ✓PCI-DSS Level 1: Zero cardholder data touches our servers; all checkouts run through Razorpay's vault.
- ✓Role-Based Access: Strict JWT cryptographic boundary separating users, owners, supporters, and admins.
- ✓CERT-In Compliance: Synchronized clock logs with mandatory 6-hour incident reporting window under Indian IT rules.
Cryptographic Data Integrity
1.1 Transit Protection: All HTTP communication between mobile clients, web dashboards, and backend microservices is strictly mandated over TLS 1.3 / HTTPS. Insecure HTTP connections are dropped at the edge gateway. Real-time WebSocket traffic operates over WSS.
1.2 Password & Credential Hashing: User passwords are encrypted using the Bcrypt adaptive cryptographic hash function with a computational work factor of 10. Passwords are never logged or stored in reversible plaintext.
1.3 One-Time Password (OTP) Cryptography: SMS OTP verification challenges are hashed in the database using SHA-256 with an environment-secret cryptographic pepper: SHA-256(phone + ':' + otp + ':' + secret). Plaintext OTPs expire in 300 seconds and are purged upon verification.
1.4 Supporter QR Token Security: Staff access credentials utilize time-limited, digitally signed QR payloads verified against SHA-256 token hashes persisted in support_staff_credentials.
Payment & Transaction Security (PCI-DSS Scoping)
2.1 Zero PAN/CVV Surface: All card data capture is offloaded directly to Razorpay's certified PCI-DSS Level 1 payment vault. The Company's backend servers never touch, transmit, or store Primary Account Numbers (PANs), card security codes (CVVs), or banking PINs.
2.2 Webhook Signature Integrity: Razorpay asynchronous payment webhooks are authenticated via SHA-256 HMAC digital signatures using dedicated webhook secret keys before any booking or ledger state transitions occur.
Access Controls & Administrative Auditing
3.1 Role-Based Access Control (RBAC): Strict structural boundary separation is enforced between 'user', 'owner', 'supporter', and 'admin' roles. API endpoints verify signed JSON Web Tokens (JWT) containing cryptographic claims on every invocation.
3.2 Immutable Audit Logging: Critical administrative actions (KYC document approvals, rejections, manual refund issuances, and ledger adjustments) are automatically recorded in the audit_logs table with actor UID, IP address, user agent, and timestamp.
CERT-In Cyber Incident Reporting Compliance
Mandatory Statutory Reporting Trigger
Any confirmed cybersecurity breach, ransomware incident, or unauthorized data exfiltration is reported to CERT-In within 6 hours under Section 70B(6) of the IT Act.
4.1 NTP System Clock Synchronization: In compliance with Directions under Section 70B(6) of the IT Act, 2000 issued by the Indian Computer Emergency Response Team (CERT-In), the Company maintains synchronized system clock logs via Network Time Protocol (NTP).
4.2 Mandatory 6-Hour Reporting: In the event of a verified cybersecurity incident, ransomware attack, unauthorized database exfiltration, or identity breach, the Company's Incident Response Team shall formally report the occurrence to CERT-In within 6 (six) hours of detection via incident@cert-in.org.in.
Statutory Grievance & Compliance Escalation
Operated in adherence to Rule 3(2) of the IT Rules 2021 & Section 13 of DPDPA 2023