Legal

Security

Last updated 22 August 2026 · Version 1.0

We operate software that handles other people’s money and personal data in a regulated industry. This page sets out how we protect it — plainly, without marketing language, so that a client’s compliance officer can assess us properly.

1 · Principles

• Fail closed. When a check cannot be completed, access is refused rather than allowed.
• Least privilege. People and systems get the narrowest access that lets them do the job.
• Everything is recorded. Access to sensitive records is logged to an append-only trail.
• Assume failure. We design for components failing, and for failing safely when they do.
• No unnecessary data. The safest data is the data we never collected.

2 · Protecting data

• In transit — HTTPS/TLS everywhere; plain HTTP is redirected, never served
• At rest — encrypted storage on managed infrastructure
• Sensitive fields — additionally encrypted at field level, so a database copy alone does not disclose them
• Secrets — held in a managed secret store, never in source code or configuration files
• Residency — data hosted in India wherever we control that choice

3 · Access control

• Multi-factor authentication on every administrative account
• Role-based permissions, reviewed when responsibilities change
• Separation of duties on money movement — the person who requests a payout is not the person who approves it
• Client credentials held only for the duration of an engagement, then returned or destroyed
• Access revoked immediately when an engagement ends

4 · Separating customers

Where we operate a system serving multiple organisations — including competitors in the same industry — separation is enforced in the database itself, not merely in application code, so a programming mistake cannot expose one customer’s data to another.

• Row-level security scoped to the organisation on every table holding customer data
• An automated isolation test that runs on every release and blocks it if separation fails
• Each organisation’s external credentials stored separately and resolved per request

5 · Secure development

• Version control with reviewed changes and a full history of who changed what
• Automated checks for secrets accidentally committed
• Dependencies monitored and updated for known vulnerabilities
• Separate development, testing and production environments — production data is never copied into testing
• Unfinished features refuse explicitly rather than pretending to work

6 · Backups and continuity

• Automated encrypted backups with point-in-time recovery
• Restoration tested rather than assumed
• Documented recovery procedures for the systems we operate
• On request, we can export a client’s complete data in a portable format at any time

7 · Incident response

If a personal data breach occurs, we will notify affected clients and the Data Protection Board of India without delay, in the form and manner required by the Digital Personal Data Protection Act, 2023 and the Rules made under it. Notification will describe the nature of the breach, its likely consequences, the measures taken, and how to contact us for more information.

Our internal sequence is: contain, assess, notify, remediate, then publish a written post-incident review to affected clients.

8 · Sub-processors

We use a small number of infrastructure and service providers. Each is engaged under terms requiring them to process data only on our instructions and to protect it appropriately. Clients are told in writing who our sub-processors are before an engagement begins, and in advance of any change. A current list is available to clients and prospective clients on request.

9 · Reporting a vulnerability

If you believe you have found a security problem in something we operate, please tell us at info@kaulinnovationandtechnologygroup.com with “Security” in the subject line. Please include enough detail to reproduce it.

• We acknowledge reports within 2 working days
• We will keep you informed while we investigate
• We will not pursue action against anyone who reports in good faith, avoids privacy violations and data destruction, and gives us reasonable time to fix the issue before disclosing it