Security Policy

1. Our Commitment to Security

At Pundeer Technologies, security is a fundamental pillar of everything we build and operate. We are committed to protecting the confidentiality, integrity, and availability of our systems, our website, and all client data we handle in the course of our work.

This Security Policy outlines the measures we implement to secure our own infrastructure, the practices we follow when building software for clients, and the process for responsible disclosure of security vulnerabilities.

2. Website & Infrastructure Security

Our website and all systems we operate are protected by the following security controls:

2.1 Encryption

• All data transmitted between your browser and our website is encrypted using TLS 1.2 or higher (HTTPS).
• SSL certificates are monitored and renewed before expiry to ensure uninterrupted secure connections.
• Sensitive data stored in our databases (such as authentication tokens and passwords) is encrypted using industry-standard algorithms.

2.2 Access Control

• Administrative access to our systems is restricted to authorized personnel only and protected with strong, unique passwords.
• Two-factor authentication (2FA) is enforced for all critical administrative accounts.
• Role-based access control (RBAC) ensures each team member can only access the data and systems required for their role.

2.3 Server & Hosting Security

• Our servers run on secured VPS environments with hardened configurations and active firewall rules.
• Server software, PHP versions, and system libraries are kept up-to-date with security patches applied promptly.
• Unused ports and services are disabled to minimize the attack surface.
• Server logs are monitored for unusual activity, failed login attempts, and anomalous traffic patterns.

2.4 Backups

• Automated daily backups of all databases and critical files are maintained.
• Backups are stored on off-server locations to ensure recovery in case of server failure.
• Backup integrity is tested on a regular schedule to verify successful restoration capability.

3. Security in Client Projects

All software, websites, and web applications we build for clients are developed with security best practices embedded throughout the development lifecycle:

3.1 Secure Coding Practices

• SQL Injection Prevention: All database queries use parameterized statements and Eloquent ORM, eliminating SQL injection risks.
• XSS Protection: All user-supplied data is escaped and validated before rendering, preventing cross-site scripting attacks.
• CSRF Protection: Laravel's built-in CSRF token system is enforced on all forms and state-changing requests.
• Input Validation: All user input is validated server-side using strict rules regardless of client-side validation.
• Authentication: Login systems implement rate limiting, account lockout after failed attempts, and secure password hashing using bcrypt.

3.2 Dependency Management

• We use only actively maintained, reputable libraries and frameworks (Laravel, React, Tailwind CSS, etc.).
• Third-party dependencies are reviewed for known vulnerabilities before inclusion in any project.
• Clients on AMC plans receive proactive dependency update notifications and patching.

3.3 Security Testing

• Basic security reviews are performed before all project deployments.
• We test for common OWASP Top 10 vulnerabilities on all client web applications.
• Client data used in testing is anonymized — no real production data is ever used in development or staging environments without explicit client agreement.

4. Data Handling & Confidentiality

• Client data, credentials, and system access details shared with us for project purposes are stored securely and shared only with team members who require access.
• Client database backups and confidential data are stored encrypted and are not retained beyond project completion unless required for AMC support.
• All team members are bound by confidentiality obligations as part of their engagement with Pundeer Technologies.

5. Vulnerability Disclosure

We take security vulnerabilities seriously. If you discover a security vulnerability in our website or any system we operate, we encourage responsible disclosure:

1. Do not exploit the vulnerability or access data beyond what is necessary to confirm the issue exists.
2. Report it to us privately by emailing [email protected] with the subject line "Security Disclosure".
3. Include a clear description of the vulnerability, steps to reproduce it, and the potential impact.
4. Give us reasonable time (typically 14-30 days) to investigate and address the issue before any public disclosure.

We will acknowledge your report within 48 hours, investigate it promptly, and keep you informed of our progress. We appreciate responsible disclosures and will credit researchers where appropriate (with their permission).

6. Incident Response

In the event of a security incident affecting client data or our own systems, we will:

• Contain and remediate the incident as quickly as possible.
• Notify affected clients within a reasonable timeframe consistent with applicable regulations.
• Conduct a post-incident review to identify root causes and prevent recurrence.
• Cooperate with any regulatory or law enforcement requirements under applicable Indian law.

7. Third-Party Services

We use trusted third-party services in our operations including Google Analytics, cloud hosting providers, payment processors, and communication tools. We select these partners based on their security practices and compliance standards. We are not responsible for the security practices of third-party services but take reasonable care to evaluate the security posture of services we integrate.

8. Policy Updates

This Security Policy may be updated periodically to reflect improvements in our security practices or changes in the threat landscape. The "Last updated" date at the top of this page reflects the most recent revision. We encourage you to review this policy from time to time.

9. Contact

For security disclosures, questions about our security practices, or to report a concern, contact us: