Security Policy
Protecting your financial data is our highest technical priority. This policy describes our security practices, our vulnerability disclosure program, and how we respond to security incidents.
1Our Security Commitment
Cashtro handles sensitive financial data including transactions, invoices, and personal financial records. We treat security not as a compliance checkbox, but as a core product quality. Our security program is built on the following principles:
🔐 Defense in Depth
Multiple layers of security controls so no single failure exposes your data.
🔍 Transparency
We disclose security practices openly and communicate incidents promptly.
🔄 Continuous Improvement
Regular security audits, penetration testing, and dependency updates.
⚡ Rapid Response
Dedicated processes to identify, contain, and remediate security issues quickly.
2Security Measures
Data Encryption
- All data in transit is protected by TLS 1.3 encryption.
- Sensitive data fields (passwords, PAN, GSTIN, financial records) are encrypted at rest using AES-256.
- Database encryption is applied at the field level for the most sensitive data.
Authentication & Access
- Passwords are hashed using bcrypt with appropriate cost factors; plaintext passwords are never stored.
- JWT access tokens have short expiry windows with secure refresh token rotation.
- Brute-force protection with progressive rate limiting and account lockout.
- Optional two-factor authentication (2FA) for enhanced account security.
- Suspicious login detection with email alerts for unrecognized devices.
Infrastructure Security
- Servers run in private VPCs with strict network security groups limiting inbound access.
- All administrative access requires multi-factor authentication.
- Regular automated security scans for known vulnerabilities in dependencies.
- Immutable audit logs for all administrative operations.
- Automated encrypted backups with point-in-time recovery.
Application Security
- Input validation and sanitization on all API endpoints.
- SQL injection prevention through parameterized queries and ORM usage.
- XSS prevention via output encoding and Content Security Policy headers.
- CSRF protection on all state-changing operations.
- API rate limiting to prevent abuse and denial-of-service attacks.
3Responsible Vulnerability Disclosure
We believe responsible disclosure of security vulnerabilities improves security for everyone. We encourage security researchers, users, and developers who discover potential security vulnerabilities to report them to us responsibly.
4Disclosure Program Scope
In Scope
- Web application at cashtro.in and associated subdomains
- Cashtro mobile applications (Android & iOS)
- Cashtro API endpoints
- Authentication and authorization systems
- Data privacy and exposure vulnerabilities
Out of Scope
- Denial of service attacks or load testing
- Social engineering of Cashtro employees
- Physical security attacks
- Vulnerabilities in third-party services not directly under our control
- Issues requiring physical access to a user's device
- Theoretical vulnerabilities without demonstrated impact
Responsible Disclosure Rules
- Do not access, modify, or delete user data beyond what is necessary to demonstrate the vulnerability.
- Do not exploit vulnerabilities beyond what is necessary to confirm they exist.
- Do not publicly disclose the vulnerability until we have had a reasonable opportunity to investigate and remediate (minimum 90 days).
- Do not violate the privacy of other users when testing.
5Reporting Process
To report a security vulnerability:
- Email a detailed vulnerability report to legal@cashtro.in.
- Include: Description of the vulnerability, steps to reproduce, potential impact, and affected component.
- Encrypt your report using our PGP public key if sharing sensitive details (key available on request).
- We will acknowledge your report within 72 hours.
- We will keep you updated on our investigation and remediation progress.
6Security Response Timeline
- Acknowledgment: Within 72 hours of receiving a valid report.
- Initial Assessment: Within 7 days — we assess severity using CVSS or similar framework.
- Critical vulnerabilities (CVSS 9+): Remediated within 24–72 hours.
- High vulnerabilities (CVSS 7–8.9): Remediated within 14 days.
- Medium/Low vulnerabilities: Remediated within 90 days.
- Disclosure: We coordinate with the reporter before any public disclosure.
7Security Incident Response
In the event of a security incident affecting user data:
- Containment: Immediately isolate affected systems to prevent further exposure.
- Assessment: Determine the scope, nature, and extent of the incident.
- Remediation: Apply patches, revoke compromised tokens, and close attack vectors.
- User Notification: Notify affected users within 72 hours as required by applicable law, including the nature of the incident and recommended user actions.
- Regulatory Reporting: Report to relevant Indian regulatory authorities as required by law (CERT-In, Data Protection Board once operational).
- Post-Incident Review: Conduct a root cause analysis and implement preventive measures.
8Security Updates
We are committed to:
- Promptly applying security patches to our infrastructure and dependencies.
- Conducting periodic penetration testing by independent security researchers.
- Reviewing and updating our security practices as threats evolve.
- Communicating significant security updates to users through in-app notifications and email.
9Security Contact
Cashtro Security Team
🛡️ Security Reports: legal@cashtro.in
🔐 Privacy Incidents: legal@cashtro.in
⏱️ Acknowledgment: Within 72 hours
🌐 CERT-In: We comply with CERT-In's cybersecurity incident reporting requirements.