Security and data handling

• //Admin access requires a password plus TOTP two-factor. 2FA is mandatory, not optional.
• //Passwords are hashed with Argon2id. We never store or transmit them in plain text.
• //Roles are least-privilege, and permissions are enforced in middleware, in every server action, and in the UI — not just hidden in the interface.
• //Every administrative mutation is written to an immutable audit log with actor, action, field-level diff, IP and timestamp.

• //TLS on every connection, with HSTS and a preload directive.
• //Third-party credentials are AES-256-GCM encrypted at rest, decrypted only in server memory, never logged, and masked in the interface.
• //Uploads are validated by magic bytes rather than by file extension, and EXIF is stripped from images.
• //Database access is least-privilege: the application user holds rights on its own schema only.

• //Every input is validated server-side against a schema. Client-side validation is a convenience, never the gate.
• //Rate limiting on all mutating endpoints, with a token bucket keyed per client.
• //Content Security Policy, X-Content-Type-Options, Referrer-Policy and Permissions-Policy are set on every response.
• //Rendered content is never injected as raw HTML, so neither a compromised editor account nor a hallucinated payload can execute script.

We name these rather than referring you to a generic list. Current sub-processors, and what each one sees:

• //Hosting: AWS (Mumbai region) — application and database infrastructure.
• //Email delivery: configured per client, typically their own SMTP relay. We prefer sending from your domain.
• //AI processing: Anthropic — content drafting only. Delegate personal data is never sent to a model.
• //Any additional sub-processor is disclosed before it is introduced, and a client may object.

For event work we are the data processor and the organiser is the data fiduciary. We sign a data processing agreement, process only on documented instruction, limit purpose to the event, and purge on the contracted retention date.

Data stays in India. Delegate exports are provided in a documented format so the organiser can meet access and erasure requests without depending on us.

We maintain a breach notification path: on discovery, the affected fiduciary is informed within 24 hours with what we know and what we are doing, before we have all the answers.

Email sales@vconnectservices.co.in with the detail. We will acknowledge within two working days and keep you updated to resolution. We will not pursue anyone who reports in good faith, avoids privacy violations and service degradation, and gives us reasonable time before disclosing.

We do not currently run a paid bounty. We will credit you if you would like that.