Security at E Building.

1. Our Commitment

E Building handles personal and financial data for thousands of Indian families. We treat data security as a core product responsibility and a legal obligation under the DPDP Act 2023 — not an afterthought.

• All primary data stored in India (AWS + MongoDB Atlas, both Mumbai)
• No personal data sold or shared for advertising purposes
• Data encrypted in transit (TLS 1.3) and at rest (AES-256)
• Annual third-party penetration testing by a CERT-In empanelled auditor
• Statutory Grievance Officer appointed under s.8(9) of the DPDP Act

2. Data Encryption

• All data in transit is encrypted using TLS 1.3
• Sensitive fields (identity document references, bank details) are encrypted at rest using AES-256
• API keys and credentials are stored in encrypted vaults, never in source code
• Database backups are encrypted and stored in a separate AWS region

3. Access Controls

• Role-based access control (RBAC): Committee admins, guards, residents, vendors, and agency workers each see only the data their role requires
• Principle of least privilege: Each system component and internal service account has only the minimum permissions required
• JWT session management: Improved token security — tokens are issued with defined lifetimes and verified on every request
• HTTP security headers: Implemented across all endpoints using Helmet.js — preventing common web vulnerabilities
• Audit logging: Every data access, login event, admin action, and permission change is logged with timestamp, user ID, and IP address
• Cron job security: All scheduled job endpoints are protected with secret key validation — not triggerable externally
• Swagger / API documentation: Not accessible in production environments

4. Security Testing

• Annual penetration testing: By an independent CERT-In empanelled auditor, covering our web application, APIs, and mobile apps. Also performed after any material architecture change. First test is being scheduled.
• Code security reviews: All code changes go through automated static analysis before deployment
• Dependency scanning: Automated scans for known vulnerabilities. Critical CVEs patched promptly.
• Security training: All E Building engineers complete security awareness training during onboarding

5. Backups & Disaster Recovery

• Automated daily backups: Full database backups encrypted and stored in a separate AWS region with 30-day retention
• Point-in-time recovery: Database transaction logs enable restoration to any point within the last 7 days
• Disaster recovery: RTO 4 hours, RPO 1 hour. Recovery process tested quarterly.

6. Security Incident Response

We maintain a documented incident response plan with defined roles and escalation procedures.

• Detection: Automated alerting on anomalous access patterns, failed authentication, and data access anomalies
• Containment: On-call team available to isolate incidents within 1 hour of detection
• CERT-In notification: Cybersecurity incidents reported to CERT-In within 6 hours of detection, as required by the IT (Amendment) Act 2000, section 70B(6)
• Data Protection Board notification: Personal data breaches reported to the Data Protection Board of India within 72 hours of confirmation
• Society notification: Affected societies informed within 24 hours of a confirmed breach
• Individual notification: Affected data principals informed without undue delay
• Post-incident review: Root cause analysis completed within 7 days of every confirmed incident

7. Regulatory Compliance

• Digital Personal Data Protection Act, 2023 (DPDP Act): EBuilding operates both as a Data Fiduciary (for marketplace, vendor, and account data) and as a Data Processor (for society-managed data under a written Data Processing Agreement). Consent management, data principal rights, Grievance Officer appointment, and data localisation are implemented in line with the Act and the DPDP Rules 2025.
• IT Act 2000 & CERT-In: Cybersecurity incident reporting obligations under section 70B(6) are embedded in our incident response procedures.
• PCI-DSS: Payment data handled exclusively by Easebuzz, a PCI-DSS compliant payment gateway. E Building does not store, process, or transmit raw card data.
• GST compliance: E Building is not currently GST-registered. Once annual turnover crosses the applicable threshold, GST will apply to all platform fees from that date.

8. Responsible Disclosure

We welcome security researchers who responsibly disclose vulnerabilities. If you believe you have found a security vulnerability in E Building:

1. Email support@ebuilding.in with “Security Disclosure” in the subject line
2. Provide a clear description and steps to reproduce
3. Give us reasonable time to investigate and patch before public disclosure

We commit to: acknowledging reports within 48 hours, keeping you informed of our investigation, and not pursuing legal action against good-faith researchers who follow this process.

9. Security & Grievance Contact