Security Policy

Safety data is sensitive. ThinkAIQ LLP maintains technical and organisational safeguards designed to protect personal data against unauthorised access, loss, alteration and disclosure, as required by section 8(5) of the DPDP Act 2023 and applicable CERT-In directions.

1. Security measures

• Encryption in transit: HTTPS/TLS for all website, app and API traffic; HSTS in production.
• Encryption at rest for sensitive columns: dedicated phone/contact columns and recoverable QR tokens use AES-256-GCM envelope encryption; keys live in the deployment environment, not in the database. Sensitive free-form QR fields (phone numbers, medical notes, allergies, safe word, pickup person, conditions) also use AES-256-GCM field-level encryption; all profile fields are access-controlled and masked in the helper view. Profile photos are access-controlled and protected by database/backup encryption at rest; because of their size they are not individually field-encrypted.
• One-way credentials: PINs and security answers use PBKDF2-SHA256 with per-user salts; OTPs use HMAC-SHA256. Plaintext is never stored.
• Tenant isolation: PostgreSQL Row-Level Security with forced policies and tenant-scoped queries; cross-tenant tests in CI.
• Access control: role-based access, least privilege, device binding, short-lived access tokens and session revocation for sensitive actions.
• Abuse prevention: rate limits on auth, scanning and emergency routes; alert throttling; CSRF protection; strict security headers.
• Logging and monitoring: structured audit logs with hashed IPs, no raw phone numbers or secrets; health checks and alerting.
• Retention and deletion: scheduled expiry/retention sweeps and verified deletion requests.
• Supply chain: dependency audit and secret scanning in CI; lockfile-pinned installs.
• People and process: least-privilege production access, secret rotation, incident response and post-incident review.

No service can be perfectly secure. We do not claim otherwise, and we continuously improve these controls.

2. Responsible disclosure

If you believe you have found a security vulnerability, email contact@thinkaiq.com with:

• A description of the issue and its potential impact.
• Steps to reproduce, including the URL/endpoint and any test account (do not use another person's account).
• A proof of concept, screenshots or logs with secrets redacted.
• Your name/handle and whether you want credit.

3. Safe harbour

If you act in good faith, avoid privacy violations, avoid destroying data, avoid interrupting the Service, and give us reasonable time to fix the issue before public disclosure, we will:

• not initiate legal action or report you to law enforcement for the research itself;
• work with you to understand and resolve the issue;
• acknowledge your contribution if you wish.

This safe harbour does not cover extortion, data theft, unauthorised access to other users' data, denial-of-service, social engineering of our staff or users, or testing on production accounts you do not own.

4. Out of scope

• Reports from automated scanners without a demonstrated impact.
• Missing headers or best-practice suggestions with no exploit path.
• Attacks requiring a rooted/jailbroken device, a compromised carrier, or physical access to a locked device.
• Third-party services (report those to the provider directly).
• Spam, rate-limit or self-XSS reports that do not affect another user.

5. Response targets

6. Incidents and notifications

We maintain an incident-response plan covering detection, containment, eradication, recovery and review. If a personal data breach occurs, we notify the Data Protection Board of India and affected Data Principals without delay in the prescribed manner, and report cyber incidents to Indian Computer Emergency Response Team (CERT-In) within 6 hours of noticing them (as required by CERT-In's April 2022 directions), and we retain system logs, ICT logs and access records for 180 days within India so incidents can be investigated. We do not hide incidents or delay notification to protect reputation.

7. Account security tips

• Use a unique PIN; do not reuse your bank or phone PIN.
• Keep your device locked and the app updated.
• Never share your PIN or OTP. We will never ask for them by email or call.
• Review device bindings and remove devices you do not recognise.
• Report a lost device promptly so we can revoke sessions.

8. Contact

Security: contact@thinkaiq.com
Grievance: contact@thinkaiq.com
A machine-readable security contact is published at /.well-known/security.txt.