Security Policy

Sahayogi stores client data on cloud infrastructure located in India wherever technically and commercially feasible, consistent with our commitment to data localisation under the Digital Personal Data Protection Act, 2023.

Sahayogi Cloud services (Tally on Cloud, Busy on Cloud, VPS, Dedicated Servers) are hosted on infrastructure specified in each client’s service agreement. For Microsoft 365 and Azure services resold through Sahayogi Cloud, data residency is subject to Microsoft’s data centre region selection.

Sahayogi uses established cloud infrastructure providers with their own security certifications and compliance programmes. Our selection of infrastructure providers considers:

• Availability of Indian data centre regions
• Provider security certifications (ISO 27001, SOC 2, or equivalent)
• Data processing agreement terms aligned with the DPDP Act
• Business continuity and uptime commitments

All data transmitted between your device and Sahayogi products is encrypted using Transport Layer Security (TLS) 1.2 or higher. This applies to:

• sahayogi.in and all subdomains
• BoSS at boss.officesahayogi.com
• Sahayogi Cloud at sahayogicloud.com
• Tax Sahayogi at taxsahayogi.in
• Sahayogi AI at sahayogi.in/ai
• All product API endpoints

HTTP connections are automatically redirected to HTTPS. Strict Transport Security (HSTS) headers are implemented to prevent downgrade attacks.

Data stored in Sahayogi’s databases and cloud storage is encrypted at rest using AES-256 encryption (or the equivalent encryption standard provided by our infrastructure platform). Encryption keys are managed separately from the data they protect.

Backup data is encrypted to the same standard as primary data. Backup configuration and retention periods are defined per product and documented in the relevant service agreements.

Access to production systems, client data, and internal tools is controlled on the principle of least privilege — each team member has access only to the systems and data required for their specific role. Access rights are reviewed periodically and revoked immediately upon role change or departure.

• Multi-factor authentication (MFA) is required for all Sahayogi team members accessing production systems
• Strong password requirements are enforced across all internal systems
• Service accounts use API keys or certificates rather than shared passwords

Sahayogi product users authenticate with their registered email and password. We recommend — and where technically implemented, require — strong passwords.

• Password reset flows use time-limited, single-use tokens
• Sahayogi AI login sessions are time-limited and require re-authentication after inactivity

In multi-tenant Sahayogi products (BoSS, Sahayogi AI), each client’s data is logically isolated from other clients. One client cannot access another client’s data. Isolation is enforced at the application and database layer.

Sahayogi’s engineering team follows secure development practices including:

• Input validation and sanitisation to prevent injection attacks
• Output encoding to prevent cross-site scripting (XSS)
• Protection against cross-site request forgery (CSRF)
• Parameterised queries to prevent SQL injection
• Dependency vulnerability scanning for open-source libraries
• Security review as part of the development process for significant changes

We conduct periodic security reviews of our products and infrastructure as part of our development and release process.

Known vulnerabilities in Sahayogi’s software dependencies are tracked and patched. Critical security patches are applied within our standard release cycle. Non-critical patches are applied within regular release cycles.

Email: info@sahayogi.in
Subject: “Security Vulnerability Report — [Brief Description]”

• The affected product, URL, or endpoint
• A description of the vulnerability and how it can be reproduced
• The potential impact if exploited
• Your contact details for follow-up

• We will acknowledge your report within 2 business days
• We will not take legal action against researchers who report vulnerabilities in good faith, provided they do not exploit the vulnerability, access or modify other users’ data, or disrupt the service
• We will keep you informed of our progress and credit your discovery (with your permission) once the vulnerability is resolved

Please do not perform destructive testing, do not access or exfiltrate client data, and do not disclose the vulnerability publicly before we have had a reasonable opportunity to address it (we ask for a minimum of 30 days from acknowledgement before public disclosure).

Sahayogi maintains logging and monitoring across its production infrastructure to detect:

• Unauthorised access attempts
• Unusual data access patterns
• System errors and anomalies
• Availability and performance degradation

In the event of a confirmed security incident:

1. 1.Contain — Isolate affected systems to prevent further impact
2. 2.Assess — Determine the scope and nature of the incident, including what data may be affected
3. 3.Notify — Where the incident constitutes a personal data breach under the DPDP Act, notify the Data Protection Board of India and affected individuals as required by law. For clients affected by a breach involving their data, we will notify the client organisation as promptly as circumstances allow and in accordance with applicable legal requirements
4. 4.Remediate — Address the root cause and restore affected systems
5. 5.Review — Conduct a post-incident review to prevent recurrence

Sahayogi maintains a business continuity plan to ensure that critical services can be restored in the event of a major incident. Recovery time objectives (RTOs) and recovery point objectives (RPOs) for each product are defined in the relevant service agreements.

All Sahayogi team members sign confidentiality agreements covering client data and sensitive business information before accessing any production systems or client data.

Sahayogi team members receive security awareness training covering phishing recognition, password hygiene, data handling, and incident reporting. Training is conducted at onboarding and refreshed periodically.

Team members with access to client data are subject to screening appropriate to their role and access level.