Security & Data Policy

1. ENCRYPTION

• All data in transit is encrypted using TLS 1.2 / TLS 1.3
• Sensitive data at rest is encrypted using AES-256
• API keys and credentials are stored using one-way cryptographic hashing
• Device lock/unlock commands are transmitted over encrypted, signed API channels

2. ACCESS CONTROLS

• Role-based access control (RBAC) across all internal systems
• Multi-factor authentication (MFA) mandatory for all admin and finance partner accounts
• API rate limiting and IP whitelisting for finance partner integrations
• Audit logs maintained for all lock/unlock events, API calls, and admin actions

3. INFRASTRUCTURE SECURITY

• Hosted on ISO 27001-compliant cloud infrastructure
• Web Application Firewall (WAF) and DDoS protection
• Intrusion Detection Systems (IDS) monitoring 24×7
• Regular vulnerability assessments and penetration testing
• Security patches applied within 48 hours of release

4. DEVICE COMMAND SECURITY

Our device locking/unlocking commands are a high-security function:

• All commands are digitally signed and authenticated before transmission to OEM servers
• Dual-authorisation required for bulk lock operations affecting 50+ devices
• Complete audit trail maintained for every lock/unlock event
• Emergency unlock override available to prevent abuse

5. DATA RETENTION SCHEDULE

Data Type	Retention Period
Partner account data	Duration + 5 years
Device & EMI records	7 years (statutory)
Lock/Unlock event logs	5 years
API call logs	1 year
Login / session logs	1 year

6. BREACH RESPONSE

• Immediate containment within 4 hours of detection
• Affected partners notified within 24 hours
• CERT-In and regulatory authorities notified within 72 hours per DPDPA 2023
• Root cause analysis and remediation report published post-incident

7. COMPLIANCE

• IT Act, 2000 & IT (Amendment) Act, 2008
• Digital Personal Data Protection Act, 2023
• RBI Data Localisation Guidelines
• CERT-In Security Guidelines

8. VULNERABILITY DISCLOSURE

Discovered a security issue? Please report responsibly to info@myemilocker.com. We acknowledge all verified reports within 24 hours.

9. CONTACT