Security and responsible disclosure

How we protect the platform

The platform holds case records, notices and personal data of people in arbitrations. We protect it in layers. We describe them here in general terms only; details that would help an attacker are not published.

• Where data is kept. Case records and documents are stored with Microsoft Azure in its Central India region. Some outside services that deliver messages and run video hearings process data outside India; the sub-processors page lists them.
• Encryption. All traffic to the website, the portal and the API uses HTTPS. Phone numbers and email addresses are encrypted before they are stored.
• Passwords and codes. Passwords are stored only as strong one-way hashes. Passwords, one-time codes and access codes are never written to logs.
• Accounts. Staff, Client and arbitrator accounts use two-step verification, and sensitive actions ask for it again.
• Access. Each role sees only what it needs. Respondents see only their own case, and only the documents released to them. Each firm's records are kept apart by the database itself.
• A record that cannot be quietly changed. Every change to a case is written to an append-only audit log that the application cannot edit or delete, and the log is chained so that a changed entry can be detected.
• Outside services. Each provider sits behind its own connection that staff can switch off, and every outgoing message carries a unique key so a retry never sends it twice.
• No payments. The platform takes no payments and holds no card or bank details.

The security and data guide explains more for users of the platform.

If something goes wrong

India's CERT-In Directions of 28 April 2022, issued under section 70B of the Information Technology Act, 2000, require us to report certain cyber security incidents, such as a data breach, a data leak or unauthorised access to systems, to CERT-In (the Indian Computer Emergency Response Team) within 6 hours of noticing them. We follow that duty.

If an incident affects your personal data, we will tell you without undue delay what happened, what it means for you, what we are doing about it and what you can do. From 13 May 2027 the Digital Personal Data Protection Rules, 2025 also require us to tell the Data Protection Board of India, with a detailed report within 72 hours.

Messages in our name

The sign-in and case links we send point to abirnyayasetu.com. Be wary of a link to any other address that claims to be ours. If you doubt a message, do not click and do not pay; send it to support@abirnyayasetu.com with the subject Suspicious message. The respondents page explains how to check a notice.

Report a security problem

If you believe you have found a security weakness in the platform, please tell us. Email support@abirnyayasetu.com with the subject Security report. Include:

• the web address or part of the platform affected;
• what the problem is and what someone could do with it;
• the steps to reproduce it, with screenshots or a short proof of concept;
• the date and time you tested, and the IP address you tested from, so we can tell your tests apart from an attack;
• how to reach you, and whether you would like to be thanked by name.

We do not have an encryption key for reports yet. Do not put personal data you came across into your email; describe what kind of data it was instead.

The same contact is published in machine-readable form at /.well-known/security.txt.

What is in scope

In scope

• The website at abirnyayasetu.com, including the public pages, the staff and Client screens, the arbitrator screens and the respondent portal.
• The platform's API served from the same address.

Out of scope

• Services run by other companies that we use, such as Microsoft Azure, Cloudflare, Meta (WhatsApp), CallMissed and Google. Report problems in those to the company concerned.
• Attacks on people: phishing, social engineering or pretending to be someone, aimed at our staff, Clients, arbitrators or respondents.
• Physical attacks on offices or equipment.
• Denial of service, load or stress testing.
• Reports from automated scanners with no demonstrated effect, and best-practice suggestions with no realistic way to cause harm.

What not to do

The platform carries real arbitration cases. Testing must never harm the people in them.

• Do not access, copy, change or delete data that is not yours beyond the minimum needed to show the problem. If you reach personal or case data, stop and report it straight away, and delete anything you kept.
• Do not cause messages to be sent to real people. Triggering notices, one-time codes or emails to anyone else is not allowed.
• Do not try to guess or flood sign-in, one-time codes or access codes, and do not lock other people out.
• Do not use accounts or access codes that are not yours. There is no public sign-up; do not try to obtain an account by misleading anyone.
• Do not upload malware or anything harmful, and do not leave anything behind on the platform.
• Do not disrupt the service or degrade it for others.
• Do not publish or share details of the problem until we have fixed it, or until 90 days after your report, whichever comes first, unless we agree otherwise.

Our promise if you act in good faith

If you look for weaknesses in good faith, follow the rules on this page, and report what you find to us promptly and only to us, then:

• we will not take legal action against you, or ask the police or any authority to act against you, for that research;
• we will work with you to understand and fix the problem; and
• we will not share your name or contact details without your permission, unless a law or a court requires it.

This promise is ours alone. It cannot bind other companies, the Clients whose cases are on the platform, or the authorities, and it does not cover anything that breaks the law in some other way, such as keeping or sharing personal data. If you are unsure whether something is allowed, ask us first at support@abirnyayasetu.com.

What happens next

• We acknowledge your report within 3 working days.
• We tell you whether we can reproduce it, and what we plan to do, within 10 working days.
• We keep you informed until it is fixed, and tell you when it is.

We do not run a paid bug bounty and cannot offer payment for reports. With your permission, we are glad to thank you by name once the problem is fixed.