Security

1. Security principles

• Least-privilege and role-based access where appropriate.
• Separation between public and protected workflows.
• Controlled administrative access.
• Secure software-development and change-management practices.
• Logging, monitoring and incident investigation capabilities.
• Backup and recovery measures appropriate to service requirements.

2. Data protection safeguards

IWOCAL seeks to use risk-appropriate technical and organisational safeguards for personal data and sensitive operational information.

Controls may include secure transport, protected credentials, access controls, logging, encryption, pseudonymisation or other measures where appropriate.

3. Infrastructure and access

• Production and administrative access should be limited to authorised personnel.
• Authentication and access rights should be reviewed when responsibilities change.
• Secrets and credentials should not be stored in publicly accessible source code.
• Administrative interfaces should use appropriate authentication and network controls.

4. Application security

• Review authentication, authorisation and sensitive workflows.
• Validate input and protect against common web-application attacks.
• Review dependencies and vulnerabilities appropriate to the technology stack.
• Perform security testing before significant releases where appropriate.
• Prioritise remediation according to severity and operational risk.

5. Monitoring, logging and incidents

IWOCAL may retain technical and security logs for operations, fraud prevention, investigation and applicable legal obligations.

Security incidents are assessed according to affected systems, information involved, legal obligations and risk to users.

6. Cyber-security reporting

Where applicable, IWOCAL will follow cyber-security reporting, log-retention and cooperation requirements imposed by competent authorities, including applicable CERT-In directions.

Incident handling and reporting obligations depend on the nature of the incident and the legal requirements applicable at the relevant time.

7. Third-party security

Cloud, hosting, communications, analytics and other service providers may form part of IWOCAL’s service delivery.

Reasonable access, contractual and security controls should be applied to service providers according to risk.

8. Responsible disclosure

If you believe you have identified a security vulnerability affecting IWOCAL, submit a security report through the official Contact page.

Do not access, modify, download or disclose other users’ information, perform denial-of-service testing, use social engineering or exploit a vulnerability beyond what is reasonably necessary to describe the issue.

9. User security responsibilities

• Use strong and unique passwords.
• Do not share OTPs, authentication links or credentials.
• Keep devices, browsers and operating systems updated.
• Report suspected account compromise promptly.
• Do not upload unnecessary confidential or sensitive information.

10. No absolute-security guarantee

No digital platform can guarantee absolute protection against every threat.

IWOCAL seeks to improve security controls over time based on risk, system changes, vulnerabilities and applicable requirements.