Security Policy

Commitment

Yarsa AllWorkss (OPC) Pvt Ltd is committed to maintaining the security, confidentiality, integrity, and availability of all data processed by ABIS (Allworkss Business Intelligence Suite). This document describes our technical and organisational security controls.

1. Infrastructure Security

2. Data Encryption

• In Transit: TLS 1.3 enforced for all connections (HTTPS only); HSTS enabled
• At Rest: PostgreSQL data encrypted at rest using AES-256 (Railway managed)
• Session Tokens: HMAC-SHA256 signed tokens; cryptographic key stored as environment secret
• Passwords: No passwords stored — authentication is Google OAuth only
• Payment Data: Card/UPI data never touches ABIS servers — processed entirely by Razorpay (PCI-DSS Level 1)

3. Authentication & Access Control

• Authentication via Google OAuth 2.0 (no ABIS-managed passwords)
• Session cookies: HttpOnly, Secure, SameSite=Lax, 30-day expiry, HMAC-signed
• Role-based access: standard users, admin accounts (environment-variable controlled)
• Database: least-privilege roles; application user has no DDL permissions in production
• API endpoints: session-cookie authenticated; all payment callbacks verified via Razorpay HMAC signature

4. Application Security

• Injection: Parameterised SQL queries throughout (no string concatenation)
• File Downloads: Path traversal prevention — file server validates all paths are within allowed directory
• XSS: Content Security Policy headers; JS injection from user inputs not evaluated
• CSRF: State parameter in OAuth flow; session tokens bound to HMAC
• Payment Integrity: Razorpay webhook signatures verified before any order status update
• Dependency Management: Dependencies pinned; regular security updates applied

5. Data Minimisation & Retention

• Report input data (uploaded by user) deleted from memory/server within 24 hours of report generation
• Generated PDFs/PPTs available for download for 7 days, then deleted
• Only report metadata (score, grade, module) is permanently stored — not raw input data
• Logs retain IP addresses for 90 days for fraud/abuse detection

6. Third-Party Security

7. Incident Response

1. Detection: Automated alerting on anomalous DB access, failed auth spikes, payment anomalies
2. Containment: Affected sessions invalidated; compromised credentials rotated within 1 hour
3. Notification: Affected users notified within 72 hours of confirmed breach
4. Regulatory: CERT-In notified within 6 hours per IT Amendment Rules 2022
5. Post-Mortem: Root cause analysis documented and shared with affected customers

8. Responsible Disclosure

We welcome security researchers to responsibly disclose vulnerabilities. Email theallworkss@gmail.com with subject SECURITY REPORT. We commit to:

• Acknowledge receipt within 24 hours
• Provide status updates every 7 days
• Not pursue legal action against good-faith researchers
• Credit researchers (with consent) after patch deployment

9. Compliance Framework