Security

01 Our security program

RPACPC operates a security program covering people, process, and technology. Policies are reviewed regularly, staff undergo security training, and access to systems follows the principle of least privilege.

02 Encryption

All data is encrypted in transit using TLS and at rest using strong, industry-standard algorithms. API access requires authenticated, token-based credentials over secure channels.

03 Access control

• Role-based access control with least-privilege defaults.
• Multi-factor authentication for administrative access.
• Audited, time-bound access to production systems.
• Segregation between sandbox and production environments.

04 Certifications & alignmen

Our controls are aligned with recognised frameworks and Indian regulatory expectations:

• ISO/IEC 27001 — information security management.
• SOC 2 — security, availability, and confidentiality controls.
• RBI-aligned — controls mapped to RBI guidance for regulated entities.
• DPDP-compliant — see our DPDP Statement.

05Infrastructure & resilience

Services run on hardened, monitored infrastructure with network segmentation, automated patching, and regular backups. We design for high availability and maintain disaster-recovery procedures.

06 Monitoring & audit

Every API request is logged with a reference ID and timestamp, producing a tamper-evident audit trail. We continuously monitor for anomalies and retain logs as required for security and compliance.

07 Testing & assessments

08 Responsible disclosure

We welcome reports from security researchers. If you believe you have found a vulnerability, please report it responsibly to our security team and allow us reasonable time to investigate and remediate before public disclosure.