Security Policy

2. Safeguards We Maintain

We apply the following safeguards, as applicable to the nature of the data and the service:

• Access controls and authentication, including authenticated APIs. • Encryption in transit and at rest, or equivalent protection. • Logging and monitoring. • Backups. • Incident response procedures. • Restrictions based on a need to know. • Due diligence and controls over our service providers. • Contractual safeguards with our processors and service providers.

3. Incident Response and Breach Notification

We maintain incident-response and escalation procedures to identify, assess, contain, remediate, document and respond to suspected personal data breaches. Where required by applicable law, we will notify affected individuals, affected clients and the competent authorities — including the Data Protection Board of India — without undue delay and within the applicable statutory timelines. Where a cyber incident is reportable to CERT-In or another competent authority, we will comply within the applicable statutory timeline, including, where applicable, the six-hour reporting period under applicable CERT-In directions.

4. Shared Responsibility

Security is a shared responsibility. Each client and user must maintain appropriate device, credential and personnel security, and must promptly report any suspected security incident to support@flashfox.ai.

5. No Guarantee

No system, and no method of transmission or storage, can be guaranteed to be completely secure. The descriptions in this policy explain our current approach and do not create a guarantee that an incident will never occur.

6. Contact

For security questions or to report a suspected incident, contact support@flashfox.ai.