Security Policy

1. Our approach

EthicsComputer LLP runs an information security management system (ISMS) certified to ISO/IEC 27001:2022. We are also certified to ISO 9001:2015 and ISO/IEC 20000-1:2018; the certificates are on our About page. Under the ISMS we assess information security risks, choose controls to deal with them, and check those controls through internal audits and management reviews.

The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 recognise ISO/IEC 27001 as a reasonable security practice. We also follow the CERT-In Directions of 28 April 2022 and the security duties of the Digital Personal Data Protection Act, 2023 and its Rules as their provisions come into force. Our registrations, certifications and the laws we follow are listed on our Compliance page.

This policy covers this website, the client, partner, employee and intern portals, our internal systems, and the client systems and data we handle during projects. No system is completely secure; this page explains what we do and what to do if something goes wrong.

2. Safeguards on our website and portals

• Encryption in transit: every page is served over HTTPS. Plain HTTP requests are redirected to HTTPS, and browsers are told to use HTTPS only (HSTS).
• Passwords: stored only as bcrypt hashes, never in readable form. "Remember me" tokens and one-time passwords are also stored only as hashes.
• Sign-in protection: an account is locked for 15 minutes after 5 failed sign-in attempts. Sessions get a new ID at sign-in, are tied to the browser and network address that signed in, and end after one hour without activity.
• Session cookies cannot be read by scripts, are sent only over HTTPS on our live site, and are not sent with requests started by other websites (SameSite).
• Forms: protected against cross-site request forgery (CSRF) with a security token, and against fake enquiries with SMS one-time passwords (codes valid for 10 minutes, 5 tries per code, limits per number and per IP address).
• Access by role: each portal (client, partner, employee, intern, HR and admin) shows only what that role needs.
• Private files: resumes, KYC copies, staff documents, attendance selfies and face enrolment images are served only to signed-in, authorised users through an access-checked gateway, and are marked not to be indexed or cached. Uploaded files cannot run as scripts.
• Browser protections: headers that stop other sites framing our pages and stop browsers guessing file types.
• Payments: card, UPI and net-banking details are entered on the payment gateway's page (Razorpay, Cashfree or PayU) and never reach our servers.
• Records: sign-ins and key actions in the portals are logged with the IP address and browser used, and failed sign-in attempts are counted for each account.

3. People and access

• Staff and interns get access only to the systems and data their work needs.
• Staff and interns sign confidentiality agreements, and every client project is covered by a mutual NDA (see our NDA & Confidentiality Policy).
• When someone leaves or changes role, we remove or change their access on their last working day.

4. Client data and access during projects

When you give us access to your systems or data for a project, you remain in charge of that data. We act as your processor and use it only for the work in the written specification you approved.

• Least access: we ask only for the access the work needs, and prefer separate named accounts for our engineers over shared passwords, with time limits where your systems allow them.
• Credentials: passwords, keys and tokens you give us are kept in access-restricted systems, shared only with the engineers assigned to your project, and never posted in public channels or code repositories.
• Test data first: we use test or sample data where possible, and use real personal data only when the work needs it and you have agreed.
• Other providers: we tell you before any third-party service processes your data as part of the project.
• At the end: on completion and full payment we hand over the full source code, intellectual property and documentation. We return or delete your data and our working copies within 30 days of sign-off, unless a support or maintenance contract or the law needs us to keep them; remove the accounts and test data we created; and ask you to remove our access and change any passwords or keys you shared.

Confidentiality terms are in our NDA & Confidentiality Policy, and how we handle personal data is in our Privacy Policy.

5. Security audits and VAPT

• Written authorisation first: we test only after a person entitled to authorise it has approved, in writing, the scope: the systems, addresses and applications to test, the types of test, the time windows and the contacts for emergencies.
• Methods: our testing follows CERT-In guidelines and recognised methods such as the OWASP Top 10, the SANS Top 25 and NIST SP 800-115. EthicsComputer LLP is not empanelled by CERT-In; if a regulator requires an empanelled auditor, tell us before the engagement starts.
• No disruption: we do not run denial-of-service or destructive tests unless you have agreed to them in writing for a defined window.
• Serious findings: if we find a critical vulnerability or signs that your systems are already compromised, we tell your nominated contact within 24 hours, without waiting for the final report.
• Clean-up: at the end of testing we remove test accounts, uploaded test files and tools, and list them in the report so you can check.
• Reports: findings are confidential, shared only with your named contacts through an access-restricted channel, and walked through with your technical team. One free re-test is included after you fix the findings. We never publish or reuse your findings without your written consent.
• Evidence: screenshots, logs and other evidence are kept for 12 months after the final report, unless your contract says otherwise, and then deleted.

Cancellations and billing for audits are covered by our Refund & Cancellation Policy.

6. Incident response

Incidents in our own systems

1. We contain the incident, find the cause, remove it, restore normal service and record what we learned.
2. We report cyber security incidents covered by the CERT-In Directions of 28 April 2022, issued under section 70B(6) of the Information Technology Act, 2000, to CERT-In within 6 hours of noticing them. We keep the logs of our systems for 180 days, as those Directions require.
3. If personal data is affected, we inform the people affected and the Data Protection Board of India as the DPDP Rules require. See section 10 of our Privacy Policy.

Incidents in systems we build or manage for clients

We tell you without delay so that you can meet your own duties, including your own 6-hour report to CERT-In. Unless we agree otherwise in writing, you remain responsible for filing it, and we give you the technical details you need.

Emergency incident response service

Clients who use our emergency incident response service get triage within 15 minutes of contacting us and a 2-hour service level, as set out in that service's terms. Report an incident on +91 90532 10052 or at info@ethicscomputer.in.

7. Reporting a vulnerability in our website

We welcome reports from security researchers. If you find a vulnerability in ethicscomputer.in, email info@ethicscomputer.in, the contact listed in our security.txt file. You can write in English or Hindi.

What to include

• the affected URL or feature;
• the type of vulnerability and its likely impact;
• clear steps to reproduce it, with any proof-of-concept code, requests or screenshots;
• the date and time you tested and the IP address you used; and
• your name or handle and how to contact you.

What we do

1. We acknowledge your report within 48 hours.
2. We check it and tell you whether we can reproduce it and how we plan to fix it.
3. We keep you updated and tell you when it is fixed.

Please keep the details private until we have fixed the issue and agreed with you when it can be disclosed.

8. Scope and rules for researchers

In scope

ethicscomputer.in and www.ethicscomputer.in, including the client, partner, employee and intern sign-in portals on them. Test portals only with an account that belongs to you.

Out of scope

• denial-of-service, load or stress testing, and high-volume automated scanning;
• social engineering or phishing of our staff, clients or partners;
• physical attacks on our offices, equipment or people;
• spam, including sending our forms or chat repeatedly, and requesting SMS codes for numbers that are not yours (each one sends a real SMS);
• guessing passwords or one-time passwords by brute force;
• services run by others that we use, such as our hosting provider, Google, the payment gateways and the SMS gateway (report to them directly);
• websites and apps we built for clients, which belong to those clients (report to the owner); and
• findings with no realistic security impact, such as missing headers or cookie flags without a working exploit, clickjacking on pages with no sensitive action, self-XSS, cross-site request forgery on sign-out, software version banners, email (SPF, DKIM, DMARC) settings, and unverified automated scanner output.

While testing

• Do not view, change, delete or download other people's data beyond the minimum needed to show the issue.
• If you come across personal data, stop, tell us, and do not keep a copy.
• Do not leave backdoors, web shells or other persistent code.
• Delete any data you obtained once you have reported it.

9. Safe harbour and rewards

If you act in good faith and follow this policy, we will treat your research on our own systems as authorised by us, will not take legal action or file a police complaint against you because of it, and will work with you to understand and fix the issue. If someone else takes action against you for research that followed this policy, we will confirm that it did.

This does not cover research that breaks these rules, demands for payment in return for not disclosing an issue, or access to more data than needed. We cannot authorise testing of systems that belong to others.

We do not run a paid bug bounty and do not pay for reports. With your permission, we will thank you by name when we publish the fix.

10. Changes to this policy

We review this policy as part of our ISMS and update it when our systems or the law change. The "last updated" date above shows the last change. For other questions, see Contact and grievance officer below.

Contact and grievance officer

We acknowledge every complaint within 48 hours and resolve it within one month of receiving it. Please include your name, phone number, the page or service concerned, and any order, invoice or transaction ID.