Security Policy

KAF Infotech LLP implements industry-standard security practices to protect client information from unauthorized access, disclosure, alteration, misuse, or destruction. Our security practices are regularly reviewed and updated to address evolving cybersecurity threats and technological advancements.

We implement appropriate safeguards to protect client data, including:

• Secure access controls
• Strong authentication practices
• Data encryption where appropriate
• Secure file storage
• Regular data backups
• Restricted employee access based on business requirements
• Continuous monitoring of critical systems

Only authorized personnel are permitted to access confidential client information.

Whenever possible, communications between clients and KAF Infotech LLP are protected using secure communication methods. Sensitive information such as passwords, API keys, payment credentials, or confidential business information should never be shared through unsecured communication channels unless specifically requested using secure methods.

For websites and applications developed by KAF Infotech LLP, we follow secure development practices that may include:

• Secure coding standards
• Input validation
• Protection against common web vulnerabilities
• Authentication and authorization controls
• SSL/TLS implementation where applicable
• Regular software and plugin updates
• Security testing during development

While we strive to build secure applications, no website or software can be guaranteed to be completely immune from cyber threats.

KAF Infotech LLP does not store customers' debit card, credit card, UPI PIN, net banking passwords, or other sensitive payment credentials. Payments are processed through trusted third-party payment gateways that maintain their own security standards and compliance requirements.

Access to client information is granted only to team members who require it to perform their assigned responsibilities. Our internal security measures include:

• Role-based access permissions
• Strong password policies
• Periodic credential reviews
• Secure device usage
• Confidentiality obligations for employees and contractors

Some of our services rely on trusted third-party providers, including:

• Cloud hosting providers
• Domain registrars
• Email service providers
• Payment gateways
• Analytics platforms
• AI service providers
• Marketing platforms
• Software integrations

While we carefully select reputable providers, KAF Infotech LLP cannot be held responsible for security incidents that originate from third-party systems beyond our control.

Clients also play an important role in maintaining security. We recommend that clients:

• Use strong and unique passwords.
• Enable Multi-Factor Authentication (MFA) wherever available.
• Keep login credentials confidential.
• Avoid sharing administrative access with unauthorized individuals.
• Notify KAF Infotech LLP immediately if unauthorized access is suspected.
• Regularly update account credentials.

KAF Infotech LLP shall not be responsible for security breaches resulting from compromised client credentials or negligence.

Where included as part of the agreed service scope, we maintain periodic backups to help recover data in the event of accidental loss or system failure. Backup frequency and retention periods may vary depending on the specific service agreement.

If a security incident affecting our systems is identified, KAF Infotech LLP will:

• Investigate the incident promptly.
• Take appropriate steps to contain and mitigate the impact.
• Restore affected systems where possible.
• Notify impacted clients when required by applicable law or contractual obligations.
• Implement corrective measures to reduce the likelihood of recurrence.

All confidential information shared with KAF Infotech LLP is handled with appropriate care and is used solely for the purpose of delivering the agreed services. We do not sell, rent, or intentionally disclose confidential client information to third parties except:

• With the client's authorization;
• To trusted service providers involved in delivering the services (subject to confidentiality obligations); or
• When required by applicable law or a valid legal process.

Although KAF Infotech LLP follows recognized security practices, no online platform, website, network, software, or electronic transmission can be guaranteed to be 100% secure. Accordingly, KAF Infotech LLP cannot guarantee absolute protection against cyberattacks, malware, phishing, unauthorized access, data breaches, internet failures, or other security threats beyond our reasonable control.

We may update this Security Policy from time to time to reflect changes in technology, legal requirements, industry standards, or our business operations. The latest version of this policy will always be available on our website.