01How we protect information
- encrypted connections (HTTPS/TLS) for our website and the systems we operate;
- multi-factor authentication and least-privilege access on business and client accounts;
- secure development practices, code review and dependency updates;
- secrets kept out of source code and stored in managed secret stores;
- regular backups, with restoration tested for managed services;
- security logging, with logs kept as required by CERT-In directions;
- assessing service providers before we use them (see Subprocessors);
- confidentiality obligations for everyone who works with us.
02Incident response
If we detect a security incident, we act to contain it, investigate and recover. We report cyber security incidents to CERT-In within the timelines set by its directions, notify affected clients without undue delay as set out in our Data Processing Agreement, and inform the Data Protection Board of India and affected individuals of personal data breaches as the DPDP Act requires.
03Reporting a vulnerability
If you believe you have found a security vulnerability in a website or system operated by Yashmitra, please email support@yashmitra.com with:
- a description of the issue and its potential impact;
- the affected URL, system or component;
- step-by-step instructions to reproduce it, including any proof-of-concept;
- your contact details, and whether you'd like to be credited.
Please don't include sensitive personal data in your report. A machine-readable contact is published at /.well-known/security.txt.
04Scope
| In scope | Out of scope |
|---|---|
|
|
05Rules of engagement
- only test against accounts and data you own, or have explicit permission to use;
- stop testing and tell us as soon as you find a vulnerability; don't access, change or delete more data than needed to demonstrate it;
- don't degrade our services or other users' experience;
- keep details confidential until we have fixed the issue and agreed to disclosure;
- comply with all applicable laws.
06Safe harbour
If you follow this policy in good faith, we will consider your research authorised, will not pursue legal action against you for it, and will work with you to understand and resolve the issue. This does not authorise testing of third-party systems.
07What to expect from us
| Step | Target |
|---|---|
| Acknowledge your report | Within 3 business days |
| Initial assessment and severity | Within 10 business days |
| Progress updates | At least every 14 days until resolved |
| Recognition | Public thanks, with your permission, once fixed |
We do not currently run a paid bug bounty programme.