Security and Data Breach

• All connections to UdyogPortal use HTTPS encryption. The Android app refuses connections that are not encrypted.
• You log in with your mobile number and a 6-digit PIN. A one-time password sent to your mobile is asked when you sign up and when you reset your PIN. We store the PIN and one-time passwords only in a hashed form that cannot be read back, and only a hash of each login token.
• After 3 wrong attempts at a PIN or one-time password, the account is locked for a while. Requests are rate-limited to slow down attacks.
• Each business’s records are kept separate, and staff see only what their role allows. The owner can see when staff signed in, from which device, and what they changed, and can remove a staff member’s access at once.
• Private files, such as ID proofs, prescriptions and bills, are kept in private storage and opened only through signed links that expire within one hour.
• Staff identity numbers (Aadhaar, PAN, passport, driving licence, UAN, PF) and bank account numbers are encrypted in the database with a key kept apart from it, and screens show them masked, such as XXXX XXXX 1234. The whole number is shown only when someone with access taps Show, and each time that is recorded.
• Resetting your PIN logs you out of every device. Logging out ends the login on that device and stops its notifications.
• Photos you upload have their hidden location and camera details removed by default.
• In the Android app, your login is kept in the app’s private storage, protected by a key in the Android Keystore, and the app’s data is excluded from phone backups.
• Important actions, such as changes to records and logins, are logged so that misuse can be traced.

• Never tell anyone your PIN or an OTP. UdyogPortal staff will never ask for them.
• Give staff only the access they need, and remove people who leave.
• If your phone is lost, reset your PIN from another device: that logs the lost phone out. Tell us if you need help.
• Report anything suspicious to support@mahaparvtechnologies.com.

1. We contain it, find out what happened and what data was affected, and fix the cause.
2. We report it to the Indian Computer Emergency Response Team (CERT-In) within 6 hours of noticing it, as the CERT-In directions of 28 April 2022 require.
3. If personal data was affected, we inform the Data Protection Board of India and every affected person as the Digital Personal Data Protection Act, 2023 and its rules require, saying what happened, what it may mean for them and what they can do.
4. If the data of a business’s customers or staff was affected, we tell that business within 24 hours of confirming it.

We keep security, login and system logs for at least one year, as the Digital Personal Data Protection Rules, 2025 require for personal data, which also covers the 180 days that the CERT-In directions require. Our servers take their time from a standard network time source so that the logs can be relied on.

Write to support@mahaparvtechnologies.com with the subject “Security”. Describe the weakness, the steps to reproduce it and its possible impact. We acknowledge reports within 72 hours and keep you informed.

Please test only against your own account, do not access, change or delete other people’s data, do not disrupt the service, and give us reasonable time to fix the issue before you make it public. We will not take legal action against research that follows these rules in good faith. We do not run a paid bug bounty at present.

Our point of contact for CERT-In and other authorities on security matters is Dhiraj Kulkarni, Designated Partner, at support@mahaparvtechnologies.com and +91 7410074195.