Information security and data storage policy

Where payment data is stored

The Reserve Bank of India's circular of 6 April 2018 on the storage of payment system data requires that the entire data relating to a payment system — the full transaction details and the information collected, carried or processed as part of a payment — is stored in systems located only in India. For a cross-border transaction, the foreign leg may also be stored abroad; and where data is processed outside India for the purpose of a transaction, it must be deleted from the systems abroad and brought back to India within twenty-four hours.

Payment data handled by the products Laitusneo operates is stored in India in line with that circular. Personal data collected through this website is covered by our privacy policy.

• RBI circular on Storage of Payment System Data (6 April 2018)
• Privacy policy

The standards our controls are held to

Laitusneo Technologies Pvt. Ltd. is ISO 27001 certified, which means an independent auditor has verified that we operate a documented information security management system covering our people, processes and technology. Our platforms are SOC 2 and GDPR compliant, and the payment technology we build is PCI DSS certified, the standard that governs any system that stores, processes or transmits card data.

Certification is not a one-off. Each of these standards requires continuing operation of the controls and periodic re-audit, and we treat a lapse in any of them as an incident.

How data is protected

Data is encrypted in transit and at rest. Access to production systems and to customer data is granted by role, to the minimum a role needs, reviewed regularly and removed when a role changes or ends. Access is logged, and the logs are retained and reviewed. Systems are tested for vulnerabilities on a schedule and after significant change, and changes to production go through review before they are deployed.

This website itself is served only over HTTPS, sends the security headers a modern browser expects, and — as our cookie notice sets out — runs no third-party scripts that could carry data elsewhere.

• Cookie notice

Security incidents

An incident is any event that compromises, or could compromise, the confidentiality, integrity or availability of data or systems we are responsible for. We investigate, contain and remediate incidents under a documented process, and we record what happened, what was affected and what was done.

The Indian Computer Emergency Response Team's directions of 28 April 2022 require the cyber-security incidents they list to be reported to CERT-In within six hours of being noticed, and require system logs to be kept for one hundred and eighty days within India. We meet those requirements, and where an incident affects a customer that is itself regulated — a bank, an NBFC or a payment aggregator with its own reporting duties to the RBI — we notify that customer promptly and with enough detail for it to meet its own obligations.

Where an incident affects your personal data, we notify you as the applicable law requires.

• CERT-In directions on cyber security incident reporting (28 April 2022)

Reporting a vulnerability

If you have found a security weakness in this website or in a Laitusneo product, we want to hear about it before anyone else does. Email info@laitusneo.com with “Security” in the subject line, describe what you found and how to reproduce it, and do not access, alter or retain data that is not yours while doing so. We acknowledge every report, keep you informed as it is investigated, and treat a report made in good faith as help rather than as an attack.

Please do not publish the details of a weakness until we have had a reasonable opportunity to fix it.

• Report a vulnerability

Availability

The availability commitments for the platforms our customers run on are in each customer's agreement. How we report availability and how to reach us about a live incident is on our system status page.

• System status

Review

This policy is reviewed at least once a year, after any significant incident, and whenever a regulation it rests on changes. The date at the top of the page is the date of the last change.