Security Policy

1. Security Commitment

ZetaGrow takes the security of our Platform, Users, and data seriously. We implement industry-standard security practices across our infrastructure, application, and processes to protect your data and ensure platform integrity.

2. Infrastructure & Network Security

• Cloud Provider: Hosted on SOC 2 Type II certified infrastructure (AWS/GCP).
• Network Segmentation: VPC isolation, private subnets, security groups, NACLs.
• DDoS Protection: Cloudflare / AWS Shield Standard for volumetric attack mitigation.
• WAF: Web Application Firewall with OWASP Core Rule Set, custom rules for API protection.
• Network Monitoring: 24/7 flow logs, VPC flow logs, intrusion detection alerts.

3. Application Security

• Authentication: PBKDF2 (10,000 iterations, SHA-256) password hashing; secure session tokens with 30-day expiry; optional 2FA (TOTP).
• Authorization: Role-Based Access Control (RBAC); principle of least privilege; attribute-based access for Work Marketplace.
• Session Management: Secure, HttpOnly, SameSite=Strict cookies; automatic expiry; concurrent session limits.
• Input Validation: Server-side validation on all mutations; Zod schema validation; parameterized queries (Convex).
• Output Encoding: Context-aware output encoding to prevent XSS; CSP headers.
• Rate Limiting: Per-user and per-IP rate limits on auth, API, and sensitive endpoints.
• Brute-Force Protection: 8 failed login attempts - 15-minute account lockout.

4. Data Protection

• Encryption in Transit: TLS 1.3 enforced for all connections; HSTS preloaded.
• Encryption at Rest: AES-256 for databases, backups, and file storage (Convex managed).
• Key Management: Cloud KMS with automatic rotation; secrets in secret manager (not in code).
• Password Hashing: PBKDF2-SHA256, 10,000 iterations, unique salt per user.
• Secrets Management: API keys, secrets in Convex secret manager; never in code or logs.

5. Access Control & Monitoring

• RBAC: Granular roles (user, content_admin, finance_admin, work_admin, super_admin).
• Admin Access: MFA enforced for all admin accounts; just-in-time access for production.
• Audit Logging: Immutable audit logs for all admin actions, privilege changes, data exports.
• Session Monitoring: Concurrent session limits; suspicious activity alerts (geo-impossible, new device).
• Audit Trail: Immutable logs for all admin actions, privilege changes, user status changes.

6. Vulnerability Management

• Dependency Scanning: Automated SCA (Software Composition Analysis) in CI/CD; automated PRs for vulnerable dependencies.
• SAST/DAST: Static and dynamic analysis in CI/CD pipeline.
• Penetration Testing: Annual third-party penetration test; remediation within 30 days for critical/high findings.
• Bug Bounty: Coordinated vulnerability disclosure via security@zetagrow.com; responsible disclosure rewarded.
• Patch Management: Critical patches applied within 48 hours; automated OS/base image updates.

7. Incident Response

• Plan: Documented IR plan with roles, communication plan, escalation procedures.
• Detection: SIEM with alerting on anomalous behavior, failed auth spikes, data exfiltration patterns.
• Containment: Automated isolation of compromised accounts/instances.
• Notification: Affected Users notified within 72 hours where required by law (DPDP Act, GDPR).
• Post-Incident: Root cause analysis, remediation tracking, lessons learned documented.

8. Business Continuity & Disaster Recovery

• Backups: Automated daily encrypted backups; point-in-time recovery (7-day retention).
• RPO/RTO: RPO < 1 hour, RTO < 4 hours for critical services.
• Multi-AZ: Deployed across multiple availability zones.
• DR Testing: Annual DR drill; runbook validation.

9. Third-Party Risk

• Vendor Assessment: Security review for all critical vendors (Convex, Razorpay, cloud providers).
• DPAs: Data Processing Agreements with all subprocessors.
• SOC 2: Preference for SOC 2 Type II certified vendors.

10. Responsible Disclosure

We welcome responsible vulnerability reports. Please email security@zetagrow.com with:

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Proof of concept (if available)

We commit to:

• Acknowledge receipt within 2 business days
• Provide remediation timeline within 10 business days
• Credit reporters (with permission) in our Hall of Fame
• Coordinate public disclosure after remediation

Do not access unauthorized data, disrupt services, or test on production without authorization.

11. Compliance

• DPDP Act 2023 (India) - data protection
• IT Act 2000 / IT Rules 2021 - intermediary guidelines
• Income Tax Act - TDS, financial reporting
• GST Act - tax compliance
• PCI DSS SAQ A - via Razorpay (payment processing)

12. Contact

Security concerns: security@zetagrow.com (PGP key available on request).