Legal

Security

Effective date: [Effective date]

Draft — under legal review
This page is a working draft and has not yet been reviewed by a lawyer. Details shown highlighted in [brackets] are still to be filled in by the company.

Summary in simple words

We protect your data with encrypted connections, hashed passwords, per-business data separation, access controls, rate limits and audit logs. We are honest about limits: we are not currently SOC 2 or ISO 27001 certified, and we do not claim to be. Report a vulnerability to us and we will respond.

What we do today

  • Encryption in transit. All sites use HTTPS (TLS); HSTS is enabled, and HTTP is redirected to HTTPS. Tenant subdomains use a wildcard certificate; custom domains get certificates when verified.
  • Passwords and login. Passwords are stored hashed (never in plain text) with password-strength validation. Logins use short-lived access tokens (about 30 minutes) with rotating refresh tokens that can be revoked. Login and sign-up attempts are rate-limited. Optional Sign in with Google.
  • Tenant separation. Every business's records are tied to its organisation and access is scoped by role (admin, staff, customer) and by module. Platform-staff access is separate from tenant admin access.
  • Credential protection. Payment gateway, WhatsApp, e-invoicing and similar API credentials that Tenants connect are stored encrypted in the database (Fernet symmetric encryption) and only the last digits are shown in the app.
  • Payments. Card, UPI and bank details are handled by Razorpay/Cashfree; we do not store card numbers. Payment webhooks are signature-verified and processed idempotently.
  • Abuse protection. API rate limits, upload type/size checks, protection against server-side request forgery in integrations, error messages that hide internal details.
  • Audit trail. Changes to key records are logged with user and IP. Accounting records have a tamper-evident edit log.
  • Documents. E-signed PDFs carry a digital-signature certificate; access to confidential documents is permission-controlled in the app.
  • Privacy by role. Billing alerts go only to Tenant admins, not to a Tenant's end customers.

What we do NOT claim

  • No SOC 2, ISO 27001 or PCI-DSS certification of VANVED itself (card data is handled by PCI-compliant gateways).
  • We do not claim whole-database or disk-level encryption at rest [FILL: confirm with hosting setup before stating anything], or multi-factor authentication [FILL: confirm status], or multi-region failover.
  • Production runs on a single server at [FILL: hosting provider & region]. Backups: [FILL: confirm before publishing].
  • No independent penetration test report is available yet [FILL: update if one is done].

Shared responsibility

Choose strong passwords, remove leavers, limit admin roles, keep gateway keys safe, and only collect data you need.

Incident response

If we find a personal data breach we will contain it, assess it, notify affected Tenants without undue delay (target within 48 hours), and report to CERT-In (within 6 hours for reportable incidents) and the Data Protection Board as required by law.

Report a vulnerability

Email [FILL: security email, or Support email] with details and steps to reproduce. Please do not access others' data, degrade service, or disclose publicly before we fix it. We will acknowledge within 3 working days. Good-faith research will not be pursued legally. [FILL: bug bounty - none at present.]

Engineering roadmap (internal, remove before publishing)

See C:\VANVED_DOCS\backend\CODE_QUALITY_AND_RISKS.md: items on backups, private media, encryption keys, monitoring should be closed before strengthening statements on this page.