Information Security Policy

This Information Security Policy outlines our security principles, infrastructure practices, and regulatory compliance approach. It applies to all employees, contractors, service providers, and third-party partners.

This Policy ensures compliance with:

• DPDP Act, 2023
• IT Act, 2000 & IT Rules, 2011
• RBI Guidelines for Payment Aggregators and Fintech Entities
• PCI-DSS standards

• Protect user data and financial transactions
• Prevent unauthorized access, data breaches, and fraud
• Establish a robust secure infrastructure
• Ensure legal, regulatory, and contractual compliance

All data is categorized and protected as:

• Confidential: Personal, financial, KYC, and payment data
• Internal: Business operations and internal communications
• Public: Approved marketing or regulatory disclosures

Sensitive personal data is encrypted both at rest and in transit as per DPDP Act.

• AES-256 encryption for data at rest
• SSL/TLS 1.2+ for data in transit
• HTTPS-only enforcement on all platforms
• Tokenization of card details per RBI & PCI-DSS
• Secure key vault management and rotation

• Role-Based Access Control (RBAC) with least privilege
• Multi-Factor Authentication (MFA) enforced internally
• Immediate deprovisioning upon employee exit
• Secure identity & access management tools

• Cloud infrastructure hosted in compliant Indian data centers
• VPC segmentation, firewalls, and intrusion prevention
• DDoS protection, rate-limiting, Zero Trust architecture
• On-premise systems follow same standards

• No storage of full card numbers or CVV post-authorization
• Annual assessments by Qualified Security Assessors (QSAs)
• Secure development practices for payment systems

Data is stored encrypted in certified data centers in India. Backup copies are distributed geographically. We operate a 24/7 SOC with real-time monitoring and SIEM tools, centralized logs, and automated alerts for anomalies or breaches.

• Regular vulnerability assessments & automated patching
• Quarterly internal audits and annual third-party testing
• Data protection impact assessments (DPIAs)
• Audit logs securely retained and reviewed

We follow a documented IRP, including identification, containment, eradication, recovery, and post-incident review. Notifications to regulators and users are sent as per legal obligations. A dedicated Incident Response Team coordinates all actions.

• Quarterly security awareness training & background checks
• Endpoint encryption and mobile device management
• Mandatory reporting of phishing or suspicious activity

• Annual policy reviews and updates
• Compliance with DPDP Act, IT Act, RBI, and CERT-In guidelines
• Approval by senior management and stakeholders