Security Practices

Our Commitment

Security is not an afterthought at Udaan Technologies — it is designed into every layer of this website, from the infrastructure we run on to the way we handle form submissions. We apply the principle of least privilege throughout: every system and every team member has exactly the access they need and nothing more.

This page describes the concrete measures in place on udaantechnologies.com. It is intentionally specific so that clients, partners, and researchers can understand our security posture without needing to ask.

Infrastructure Security

Our website and serverless functions are hosted on Vercel, a platform that holds SOC 2 Type II and ISO 27001 certifications. Vercel’s edge network handles DDoS mitigation, TLS termination, and certificate management automatically at the platform level.

Our database runs on Supabase, which is also SOC 2 Type II certified. All data stored in Supabase is encrypted at rest using AES-256.

• HTTPS / TLS 1.3 — enforced on all connections. HTTP requests are automatically redirected to HTTPS.
• HSTS — the Strict-Transport-Security header is set with a max-age of one year (31 536 000 seconds), instructing browsers to always use HTTPS for this domain.
• Content Security Policy — CSP headers are enforced to restrict which scripts, styles, and external resources can load, reducing the attack surface for XSS and injection attacks.

Application Security

Every API endpoint and every form submission goes through multiple layers of application-level protection:

• CSRF protection — all API route handlers validate the request Origin and Referer headers against an allowlist. Requests from unknown origins are rejected before any processing occurs.
• Input validation & HTML escaping — all user-supplied form data is validated server-side and HTML-escaped before being used in emails or database writes, preventing injection attacks.
• Rate limiting — every API route enforces per-IP rate limits (10–30 requests per 15-minute window depending on the endpoint). Requests exceeding the limit receive a 429 Too Many Requests response.
• File upload validation — uploaded files (job applications) are restricted to PDF, DOC, and DOCX formats with a 5 MB size cap. File type is validated server-side, not just by extension.
• X-Frame-Options: DENY — prevents this site from being embedded in iframes on other domains, blocking clickjacking attacks.
• X-Content-Type-Options: nosniff — instructs browsers not to MIME-sniff responses, preventing content-type confusion attacks.
• Referrer-Policy: strict-origin-when-cross-origin — limits the referrer information sent to third-party sites to the origin only, not the full URL path.
• Permissions-Policy — browser features that this site does not use are explicitly disabled: camera=(), microphone=(), geolocation=().

Data Protection

We collect only what is necessary to deliver our services and respond to enquiries. Here is how that data is handled:

• Data in transit — all communication between your browser and our servers is encrypted using TLS 1.3.
• Data at rest — data stored in Supabase (PostgreSQL) is encrypted at rest with AES-256.
• No payment data stored — udaantechnologies.com is a marketing and enquiry website. We do not process or store any payment card information.
• AI chatbot conversations — messages sent to our AI assistant are processed in-memory and are not persisted to any database or log store. Each conversation session starts fresh.
• Rate limit counters — per-IP request counters used for rate limiting are held in memory only. They are never written to disk and reset on every deployment.

Access Control

Access to production systems and sensitive configuration is tightly controlled:

• Environment variables via Vercel — all API keys, database credentials, and secrets are stored as encrypted environment variables in Vercel’s dashboard. They are never committed to source code or exposed in build logs.
• Regular key rotation — API keys (Resend, Anthropic, Supabase) are reviewed and rotated on a regular cadence and immediately upon any suspected exposure.
• Principle of least privilege — team members are granted only the access level required for their role. Vercel and Supabase project permissions are audited periodically.
• Repository access — the source code repository is private and access is limited to active contributors.

Responsible Disclosure

We welcome reports from security researchers. If you discover a vulnerability on udaantechnologies.com, please tell us before disclosing it publicly — we will investigate promptly and take corrective action.

How to report: Send an email to info@udaantechnologies.com with the subject line Security Report. Please include:

• A clear description of the vulnerability
• Steps to reproduce it (proof-of-concept if possible)
• The potential impact you believe it could have
• Your contact details for follow-up

We commit to the following:

• Response within 24 hours — we will acknowledge your report within one business day.
• No legal action — we will not pursue legal action against researchers who act in good faith and follow responsible disclosure practices.
• Credit — with your permission, we are happy to publicly acknowledge your contribution once the vulnerability is resolved.

Compliance

We design our data practices to meet the requirements of the jurisdictions we operate in and serve clients from:

• India IT Act 2000 — our data handling practices comply with the Information Technology Act, 2000 and its associated rules.
• SPDI Rules 2011 — we follow the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 for handling sensitive personal data.
• GDPR-aware practices — while we are based in India, many of our clients are in the EU. We apply GDPR-aligned principles — including data minimisation, purpose limitation, and consent-based analytics — across all users regardless of location.
• Internal security reviews — we conduct regular internal reviews of our security configuration, third-party dependencies, and access controls to identify and address any emerging risks.

Contact

For general security questions, vulnerability reports, or data-related enquiries, please contact us:

• Email: info@udaantechnologies.com
• Subject (for security reports): Security Report
• Website: udaantechnologies.com/contact

All security reports are treated with highest priority and will receive a response within 24 hours.