Security Policy

This Security Policy governs the technological safeguards, cloud architecture, and organizational security protocols deployed by Xarwiz Technologies LLP, Sector 62, Noida, Uttar Pradesh, India - 201301.

Our security architecture is governed by Confidentiality & Least Privilege (restricting data using Row-Level Security), Defense in Depth (multi-layered network boundaries), Zero Trust validation, and Privacy/AI Safety by Design.

Our security operations are led by our CISO, who coordinates threat assessments. DevSecOps handles pipeline safety and container updates, while Risk Management conducts quarterly audits.

We comply with India's DPDP Act 2023, IT Act 2000, CERT-In Directions (incident notification reporting within 6 hours), ISO/IEC 27001 standard practices, and SOC 2 Type II controls.

We enforce identity controls including mandatory Multi-Factor Authentication (MFA), WebAuthn Passkey authentication, SAML/OAuth SSO integrations, Role-Based Access Control (RBAC), and immediate token revocation upon user offboarding.

We classify data into: Tier 1 (Public specs), Tier 2 (Internal telemetry), Tier 3 (Confidential customer profiles), and Tier 4 (Restricted vector contexts, hashed passwords, API keys).

We enforce TLS 1.3 encryption in transit and AES-256 encryption at rest. Decryption keys are rotated annually via cloud KMS. Hashing is used for credentials.

To address the OWASP LLM Top 10 risks, we implement real-time prompt moderation, jailbreak filters, indirect prompt injection shields, and database multi-tenant RLS boundaries.

We isolate internal databases inside secure cloud Virtual Private Clouds (VPCs). Docker containers are scanned daily and traffic is routed via CDNs with DDoS mitigation.

APIs are secured using cryptographically signed JWT auth tokens, rate limiting via Redis middleware, request schema validation, and strict API key isolation.

Static analysis (SAST) and Software Composition Analysis (SCA) run automatically on pull requests. Outdated dependencies are updated daily, and secret scanners block exposed keys.

CI/CD pipeline builds require signed commits. Pipeline security and artifact signing ensure build integrity, supported by automated rollbacks.

Developer laptops enforce full disk encryption, MDM software rules, antivirus checks, and remote wipe capabilities.

We log user actions (logins, workspace updates, plan cancels) in database logs. Logs are consolidated to SIEM alerts and kept for 180 days per IT Rules 2021.

Automated monitors identify rate abuses, spikes in failed logins (indicative of credential stuffing), and prompt patterns matching jailbreaks.

We run daily composition scans. SLA for critical fixes is 48 hours; high-severity fixes within 7 days. Independent penetration tests are conducted annually.

We utilize a six-phase incident plan: Preparation, Detection, Containment, Eradication, Recovery, and Reporting. Incident alerts are reported to CERT-In within 6 hours.

Geo-redundant logical backups are created daily. Target RPO is 24 hours and RTO is 4 hours, verified by annual failover tests.

We audit subprocessors before integration. Main vendors include cloud hosts (AWS India, Cloudflare), billing gates (Stripe, Razorpay), and model providers (OpenAI, Anthropic).

Noida offices enforce visitor logs and keycards. Vector indices are stored in ISO 27001 certified AWS server centers.

Background checks are run before onboarding. Security awareness and phishing tests are conducted annually.

Users must set long passwords, activate Multi-Factor Authentication (MFA), and protect workspace keys.

Security flaws can be reported directly to security@xarwiz.com. We investigate all bug reports under responsible disclosure.

Internal code audits are run before key upgrades. Independent external compliance reviews are run annually.

Active database rows are purged within 30 days of user erasure. Billing invoices are stored for 8 years to meet statutory tax audits.

We collect minimal user metrics. Consent is requested for cross-border transfers. Check our Privacy Policy for more details.

We monitor prompt leakage, model theft risks, and output manipulation using safety boundaries.

Policy violations result in warning emails, temporary query limits, workspace suspension, or reporting to law authorities.

Xarwiz Technologies LLP, Sector 62, Noida, Uttar Pradesh, India - 201301. Grievance Officer: Ashish Pratap Singh Tomar (grievance@xarwiz.com).

Our security controls map directly to ISO 27001, SOC 2 Criteria, and the NIST CSF.

We mandate TLS 1.3 in transit and AES-256 for database tables.

Minimum 12 characters, including capital letters, numbers, and symbols.

P1 (Critical): Resolved within 12 hours. P2 (High): Resolved within 24 hours.

Enable MFA, rotate API keys, and monitor workspace member rights.

Enterprise plans support SAML SSO, Custom Vector Keys (BYOK), IP allowlists, and dedicated VPC configurations.