Security and Breach Policy
Draft for legal review. Highlighted items are still to be filled in.
In short: here is how we protect your data, what we ask you to do, how to report a weakness, and how fast we act and tell you if something goes wrong.
1. How we protect NOW
- HTTPS only, with browsers told to always use it.
- Passwords are salted and hashed. We cannot read them.
- Each request is checked against your shop, so one shop cannot reach another's records.
- Login sessions are signed, and expire after 14 days.
- Limits on repeated login, sign-up and write requests.
- Payment confirmations are verified by signature before a plan is activated.
- Our company records are behind row-level security and open only to our server.
- Secret keys are kept as encrypted secrets, never in the app or in code.
- Browser protections that block NOW pages from being embedded in other sites and limit where scripts can load from.
- Error logging, uptime monitoring, and regular backups with restore tests.
2. What we ask of you
- Use a long, unique password.
- Do not share your login. Log out on shared phones and computers.
- Share bill links only with the right customer.
- Write to us right away if you think your account was misused.
3. Reporting a weakness
If you find a security problem, write to [EMAIL]. We reply within 3 working days. If you act in good faith, do not access other people's data, do not disrupt the service, and give us reasonable time to fix it before telling others, we will not take action against you.
4. If something goes wrong
- Contain: we stop the problem and protect the data first.
- Report: we report reportable cyber incidents to CERT-In within 6 hours of noticing them, as its 2022 directions require.
- Tell you: if your data is affected, we tell you without undue delay and within 72 hours of becoming aware. We say what happened, what data was involved, what we did and what you should do.
- Regulator: once the DPDP Rules take effect, we also inform the Data Protection Board of India and affected people as they require.
- Learn: we fix the cause and review our safeguards afterwards.
5. Honest limits
No online service can promise it will never be attacked. We promise to take reasonable safeguards, act fast and be honest with you.