Data & Security

1. Overview

At YantrAdhigam Labs Pvt Ltd, protecting your data is a core priority. We implement multiple layers of security across our infrastructure, application, and operational processes. This page outlines the specific technical and organisational measures we employ to safeguard your personal and transactional data on yantradhigam.com.

2. Encryption in Transit

All data transmitted between your browser and our servers is encrypted using TLS 1.3 (Transport Layer Security), the latest and most secure version of the protocol. This ensures that any information you send or receive, including login credentials, personal details, and payment information, is protected from interception during transit.

3. Encryption at Rest

Sensitive data stored on our servers, including API keys, internal secrets, and confidential configuration values, is encrypted using AES-256 and Fernet encryption. This industry-standard approach ensures that even in the unlikely event of unauthorized access to our storage systems, the encrypted data remains unreadable without the corresponding decryption keys.

4. Password Security

User passwords are never stored in plain text. We use bcrypt with salt, an industry-standard cryptographic hashing algorithm, to irreversibly hash all passwords before storage. This means that even our own team cannot view or recover your original password. If you forget your password, you must reset it through our secure password recovery process.

5. Payment Security

All payments on yantradhigam.com are processed through Razorpay, which is PCI DSS compliant(Payment Card Industry Data Security Standard). This means that all card processing occurs within Razorpay's secure environment.

6. Access Control

Our platform enforces role-based access control (RBAC) with clearly defined roles:

• Customer: Access to own profile, orders, downloads, and support tickets only
• Admin: Access to platform management, order processing, and system configuration

Authentication is managed through JSON Web Tokens (JWT) with a 60-minute expiration. Tokens are automatically invalidated after expiry, requiring re-authentication to continue accessing protected resources.

7. Customer Data Isolation

Our application architecture enforces strict data isolation. Each customer can only access their own data, including their profile, orders, downloads, and support history. Server-side authorization checks ensure that no customer can view, modify, or delete another customer's information, regardless of the request method.

8. API Security

Our backend APIs are protected with multiple security layers:

• Rate limiting: Prevents abuse by restricting the number of requests from a single source within a given timeframe
• Origin validation: Ensures requests originate from authorized domains
• CORS restrictions: Cross-Origin Resource Sharing policies are configured to allow requests only from trusted origins
• Input validation: All incoming data is validated and sanitised to prevent injection attacks

9. Infrastructure and Backups

Our platform runs on PostgreSQL with strict access controls and connection-level security. Key infrastructure practices include:

• Daily automated backups of all databases
• 30-day backup retention period
• Database access restricted to application services only, with no direct public access
• Environment variables and secrets managed through secure configuration, never committed to source code

10. Incident Response

We maintain a structured incident response protocol to handle security events:

• All reported security incidents are investigated within 24 hours
• Affected customers will be notified within 72 hours of a confirmed breach that impacts their personal data
• Post-incident review is conducted to identify root causes and implement preventive measures
• Relevant regulatory authorities will be notified as required by applicable law

11. Vulnerability Reporting

If you discover a security vulnerability in our platform, we encourage responsible disclosure. Please report any security concerns to:

We take all reports seriously and will acknowledge receipt within 48 hours. We request that you refrain from publicly disclosing the vulnerability until we have had an opportunity to investigate and address it.

12. Contact Us

For general security enquiries or concerns, please contact us: