Legal

Security & Responsible Disclosure

How we protect this website and the systems we build for clients, how we respond to incidents, and how to report a vulnerability to us.

Effective 16 October 2026 · Last updated 16 October 2026 · Version 1.0

01Our approach

We build software that runs businesses, so security is part of how we design, write, deploy and support it. This page describes the practices we follow. Our obligations to a specific client are set out in that client's signed agreement.

These practices are our “reasonable security practices and procedures” under section 43A of the Information Technology Act, 2000 and Rule 8 of the SPDI Rules, and our reasonable security safeguards under section 8(5) of the Digital Personal Data Protection Act, 2023.

02This website

  • krhydroly.in is a static website served over HTTPS. It has no database, no user accounts and no server-side form processing.
  • It sets no cookies and runs no analytics or advertising trackers. See the Privacy Policy.
  • The inquiry form is processed entirely in your browser and handed to WhatsApp. It does not store or transmit your details to us.

03Client engagements

Before work starts

  • We sign a non-disclosure agreement before any detailed architecture review or access to your systems.
  • Where we will handle personal data in your systems, we sign a data processing agreement as your Data Processor (DPDP Act s.8(2)). It covers your instructions, confidentiality, security, sub-processors, breach notification, and the return or deletion of data at the end of the engagement. Ask us for our standard terms.

Access and credentials

  • Access is granted to named individuals on a least-privilege, need-to-know basis, and removed when they leave the project or the engagement ends.
  • Multi-factor authentication is required on our code-hosting, cloud and email accounts.
  • Credentials and secrets are exchanged through a password manager or secrets vault, never over WhatsApp or email, and are never committed to source code.
  • Wherever possible, code lives in repositories that you own and control.

Engineering practice

  • Separate development, staging and production environments. Development uses synthetic or masked data unless you approve otherwise in writing.
  • Code review for every change, automated tests, and dependency vulnerability scanning in CI/CD.
  • Encryption in transit (TLS) and at rest for systems we deploy, and role-based access control within the applications we build.
  • Privacy by design: collecting only the data a feature needs, building consent capture, notices, data-principal requests and retention-based deletion into the product when the client's DPDP obligations call for them.
  • Security patching, backups and restore testing under maintenance and support agreements.
  • Logging and monitoring sized to the system, including the 180-day log retention required by the CERT-In Directions where they apply.

04Incident response

If we become aware of a security incident affecting a client system or data we handle, we will:

  1. contain it and preserve evidence;
  2. notify the affected client without undue delay, and within the time agreed in their contract, with what we know and the steps taken, so the client can meet its own notification duties;
  3. report reportable cyber incidents to CERT-In within 6 hours of noticing them, as its Directions of 28 April 2022 require; and
  4. where we are the Data Fiduciary, inform the Data Protection Board of India and each affected person as the DPDP Act and Rules require.

05Responsible disclosure

If you believe you have found a security vulnerability on krhydroly.in or in a system we operate, please tell us privately. Email info@krhydroly.in with “SECURITY” in the subject line, or message +91 93191 66011 with the word “SECURITY”.

Please include

  • the affected URL or system;
  • steps to reproduce the issue, and its impact; and
  • how we can reach you.

Please do not

  • access, change or delete data that is not yours, beyond the minimum needed to show the issue;
  • run denial-of-service, spam or social-engineering attacks, or test physical security;
  • test the demonstration sites' fictional brands as if they were real businesses; or
  • publish the issue before we have had a reasonable time to fix it.

What we commit to

We will acknowledge your report within 3 business days and keep you updated. If you act in good faith and follow this policy, we will not pursue legal action against you for your research, and we will credit you if you wish.

We do not currently run a paid bug bounty. Our contact details are also published at /.well-known/security.txt.