Information Security Policy

Policy Statement

ClearConsent DataSec Pvt. Ltd. is committed to protecting the information assets of our customers, partners, employees, vendors and business operations within the defined scope, ensuring confidentiality, integrity, and availability through the following commitments:

1. Confidentiality – Protect sensitive information from unauthorised access or disclosure.
2. Integrity – Maintain accuracy, reliability, and consistency of information assets.
3. Availability – Ensure timely and reliable access to information and systems.
4. Compliance – Adhere to statutory, regulatory, and contractual obligations.
5. Risk Management – Identify, assess, and mitigate information security risks.
6. Awareness & Training – Build a culture of security through education and communication.
7. Continuous Improvement – Regularly review and enhance ISMS controls to address evolving threats.

1. Scope

This policy applies to all information assets owned, operated, or managed by ClearConsent DataSec, including:

• The ClearConsent DPDPA compliance platform and all supporting infrastructure
• Customer data processed on behalf of data fiduciaries
• Internal systems, development environments, and CI/CD pipelines
• All employees, contractors, partners, and third-party service providers with access to company systems

2. Encryption Standards

Data at Rest

• All customer databases are encrypted using AES-256 (Google Cloud default encryption for Cloud SQL and persistent disks)
• Backups are encrypted at the storage layer and access-controlled with IAM policies
• Sensitive fields (PII, credentials) are application-level encrypted before database storage where applicable

Data in Transit

• All external communications use TLS 1.2 or higher; TLS 1.0 and 1.1 are disabled
• HTTPS is enforced on all public-facing endpoints with HSTS headers
• Internal service-to-service communication uses encrypted channels
• SSL certificates are managed via Certbot with automated renewal

3. Access Control

• Role-Based Access Control (RBAC) – All platform access is governed by roles (CEO, Admin, HR, Recruiter, Partner, CRM User). Users are granted minimum necessary privileges
• Least Privilege – Database credentials are scoped per service; production access is limited to authorised operations staff
• Authentication – All admin and partner portals require JWT-based authentication with token expiry. OTP verification (email and SMS) is enforced for sensitive operations
• MFA for Privileged Access – Multi-factor authentication is required for access to cloud infrastructure (GCP), deployment pipelines, and production servers
• Session Management – Sessions are time-limited with automatic expiry. Tokens are stored in HTTP-only cookies where possible
• Access Reviews – User access is reviewed periodically and deprovisioned upon role change or termination

4. Vulnerability Management

Assessment

• Vulnerability Assessment and Penetration Testing (VAPT) is conducted regularly by qualified assessors
• Automated dependency scanning is performed to identify known vulnerabilities in third-party libraries
• Web application security testing covers the OWASP Top 10 vulnerability categories

Remediation

• Critical and high-severity vulnerabilities are triaged and remediated within 48 hours of identification
• Medium-severity findings are addressed within 14 days; low-severity within the next planned release cycle
• All remediation is verified through re-testing before closure

Responsible Disclosure

Security researchers who identify vulnerabilities in ClearConsent systems are encouraged to report them responsibly to security@clearconsent.in. We commit to acknowledging reports within 2 business days and providing a resolution timeline within 5 business days.

5. Incident Response

ClearConsent maintains an Incident Response Plan (IRP) that covers:

Phase	Actions	Timeline
Detection	Monitoring, alerting, and anomaly detection across application and infrastructure layers	Continuous
Containment	Isolate affected systems, revoke compromised credentials, block attack vectors	Within 1 hour of confirmation
Eradication	Root cause analysis, patch deployment, malware removal	Within 24 hours
Recovery	Restore services from verified backups, validate system integrity	Within 48 hours
Notification	Notify affected data fiduciaries and, where required, the Data Protection Board of India per DPDPA §8	Within 72 hours of confirmation
Post-Incident Review	Document findings, update controls, conduct lessons-learned review	Within 7 days

6. Secure Software Development

• Secure SDLC – Security is integrated into all phases of the development lifecycle, from design through deployment
• Code Review – All production code changes undergo peer review with security considerations as a review criterion
• Input Validation – All user inputs are validated and sanitised; database queries use parameterised statements to prevent injection attacks
• Dependency Management – Third-party libraries are reviewed for known vulnerabilities before adoption and monitored continuously
• Secrets Management – API keys, database credentials, and other secrets are stored in environment variables; never committed to source control
• Rate Limiting & CORS – API endpoints are rate-limited and CORS policies restrict access to whitelisted origins

7. Data Handling

Classification

Classification	Description	Examples
Confidential	Personal data and customer data governed by DPDPA 2023	Names, emails, phone numbers, consent records, DSAR requests
Internal	Business information not intended for public disclosure	Partner agreements, pricing models, internal reports
Public	Information approved for public access	Marketing content, published policies, press releases

Retention & Disposal

• Personal data is retained only for the duration specified in the privacy notice provided at the point of collection
• Consent records are retained for the duration of the processing relationship plus 3 years for legal defensibility
• Financial records are retained per statutory requirements (7 years under the Indian Companies Act)
• Data disposal is performed through secure deletion methods; cryptographic erasure is used where applicable

8. Infrastructure Security

• Cloud Provider – ClearConsent infrastructure is hosted on Google Cloud Platform (GCP), Singapore region (asia-south1), leveraging GCP's SOC 2 Type II, ISO 27001, and ISO 27017 certified infrastructure
• Network Security – Firewall rules enforce least-privilege network access; only required ports are exposed. Nginx reverse proxy handles TLS termination and request filtering
• Logging & Monitoring – Application and infrastructure logs are maintained for audit and forensic analysis. Access logs are retained and reviewed for anomalies
• Backup & Recovery – Automated daily backups with encrypted storage; recovery procedures are tested periodically
• Patch Management – Operating system and dependency patches are applied on a regular cadence, with critical security patches applied out-of-cycle

9. Tenant & Data Isolation

For on-premise and private cloud deployments, each customer instance operates in an isolated environment. In managed deployments:

• Tenant data isolation is enforced at the database query level, not just the UI layer
• Cross-tenant data access is architecturally prevented through scoped credentials and row-level security
• No customer personal data is transmitted to or processed by ClearConsent servers in on-premise deployments

10. Third-Party Risk Management

ClearConsent evaluates the security posture of all third-party service providers that process data on our behalf:

Provider	Service	Data Processed	Region
Google Cloud Platform	Infrastructure & Database	All application data	Singapore (asia-south1)
Resend	Transactional Email	Email addresses	United States
Twilio	SMS OTP Verification	Phone numbers	United States
Google Analytics	Website Analytics	Anonymised usage data (consent-gated)	United States

All third-party providers are bound by data processing agreements and are assessed for compliance with applicable data protection regulations.

11. Security Awareness & Training

• All employees complete security awareness onboarding within their first week
• Role-specific security training is provided for developers, operations staff, and personnel handling customer data
• Phishing awareness and social engineering simulations are conducted periodically
• Security policies are reviewed and communicated to all staff annually

12. Compliance Alignment

Framework / Regulation	Status
Digital Personal Data Protection Act, 2023 (DPDPA)	Compliant — platform is purpose-built for DPDPA compliance
DPDP Rules, 2025	Aligned with phased enforcement deadlines
Information Technology Act, 2000 (IT Act)	Compliant — reasonable security practices per §43A
ISO/IEC 27001:2022	ISMS aligned; formal certification on roadmap
OWASP Top 10	Addressed in SDLC and VAPT scope

13. Policy Governance

• This policy is owned by the CEO / Information Security Officer and is reviewed at least annually, or upon significant changes to the threat landscape, business operations, or regulatory requirements
• Policy exceptions require documented approval from the Information Security Officer
• Non-compliance is subject to disciplinary action in accordance with ClearConsent's HR policies

Request Full Policy Documentation