Security

Security Keeping our customers' data protected at all times is our highest priority. This security overview provides a high-level overview of the security practices put in place to achieve that objective. Have questions or feedback? Feel free to reach out to us at info@aifcentral.in

We will never provide any part of your information to anyone unless consented by the user. Please refer to our privacy policy for more information.

1. Data Protection Commitment • Keeping customer data protected at all times is AIF Central's highest priority. • Customer information will never be shared with any third party without explicit user consent. • For questions, feedback, or responsible disclosure, reach out via email at info@aifcentral.in.

2. Infrastructure & Peripheral Security AIF Central's infrastructure is built upon Amazon Web Services (AWS), utilizing a robust and scalable multi-level architecture.

Architectural Standards

The infrastructure strictly adheres to the AWS Well-Architected Framework to ensure security, high performance, resilience, and efficiency.

Network Segmentation

All servers are kept under a Virtual Private Cloud (VPC), and environments are isolated using subnetting. The servers are physically located in the AWS Asia Pacific Region (India).

Defense in Depth

A multi-layered security approach is implemented:

• A network and application firewall is in place. • Industry best practices, such as OWASP guidelines, are implemented. • The latest version of ModSecurity is deployed on the Web Application Firewall (WAF) to mitigate new attacks. • Distributed Denial-of-Service (DDoS) attacks are prevented using multi-level defense firewalls. 3. Data Security All users' data is managed in the encrypted format at all times, applied at both the in-transit and in-rest stages.

In-Transit Encryption

The transmission of data is protected by a bank-grade TLS encryption algorithm, which prevents man-in-the-middle and eavesdropping attacks.

Data Storage Focus

Attention is paid to data atomicity, data consistency, data integrity, and durability of the data.

Monitoring and Recovery

• Activity logging and auditing are enabled for swift intrusion detection.
• Data replication is utilized for data resiliency and disaster recovery.
• Backup testing is performed for data reliability.

Internal Access Control

• Multi-level role-based access control is implemented to secure users' data. • Access to the development server is limited through bundling identity management and secured multi-tunnel private VPN channels.

4. Application Security Authentication

Strong measures are enforced for user login:

• A strict password policy.
• A mandatory Two-Factor Authentication (2FA) protocol.

Access Control

Location-based security control is incorporated to restrict unauthorized application access.

Data Validation

All data transfers (back and forth) must pass through a data validation layer to protect the application from malicious code injections. 5. System Breach Detection & PEN-Testing Security assurance is maintained through continuous testing and auditing.

Periodic Assessments

Internal teams and external stakeholders conduct periodic security and vulnerability assessments utilizing standardized products for both manual and automated testing.

External Audits

AIF Central has engaged CERT-IN certified auditors for performing external testing and audits at regular intervals.

6. Standards & Compliance AIF Central maintains adherence to key regulatory requirements:

• NPCI: Implementation of laid-out compliance requirements and standards for the Bharat Bill Payment System (BBPS). • RBI: Compliance with the "Data Localisation" requirements as per the guidelines of the Reserve Bank of India.

7. Responsible Disclosure Policy AIF Central is committed to keeping users' data safe and encourages responsible reporting of security vulnerabilities.

Reporting Method

If a potential security vulnerability is identified, report it responsibly by writing to info@aifcentral.in.

Report Requirements

Include supporting screenshots/videos and detailed steps to reproduce the vulnerability.

Commitment

AIF Central will put its best efforts into addressing and fixing the issue within a reasonable timeframe.

Non-Disclosure Reporters are requested not to disclose the vulnerability publicly in the meantime.

Response Time

A response will be sent as soon as possible, usually within 3 days, indicating how the case will proceed.

Confidentiality

The report will be treated confidentially.

Legal Note

If the vulnerability is used for unlawful gains, legal action may be taken. If the guidelines are adhered to, no legal action will be taken on the report, and the reporter will be mentioned as the discoverer (with permission).