Public security policy
Security Policy
This page describes how PoojaPatha protects your data, secures your account, and handles the responsible disclosure of security vulnerabilities.
Data protection
All personal data collected by PoojaPatha — including contact details, booking history, and payment records — is stored in encrypted form at rest and transmitted exclusively over TLS-encrypted connections. We do not store raw payment card numbers; payment processing is handled by PCI-DSS compliant third-party gateways.
Account security
PoojaPatha uses OTP-based phone authentication — there are no passwords to leak or reuse. Each session is tied to a short-lived token. Signing out invalidates your session immediately across all devices.
Access controls
Access to production systems and customer data is restricted to authorised personnel on a need-to-know basis. All internal access is logged and periodically reviewed. No third party receives personal data unless required for service delivery or compelled by law.
Payment security
Payments are processed through a certified payment gateway. Card and UPI credentials are never transmitted to or stored on PoojaPatha servers. Payment pages are served over HTTPS with strict transport security headers.
Vulnerability disclosure
If you discover a potential security vulnerability in our platform, please report it responsibly to grievance@poojapatha.com with a clear description of the issue. We review all reports and respond within a reasonable timeframe. Please do not publicly disclose findings before we have had a chance to investigate.
Incident response
In the event of a data breach or security incident that affects your personal information, we will notify affected users in accordance with applicable law. Notifications will be sent via the contact details registered with your account.