Institutional cybersecurity protocols, cryptographic standards, multi-layered cloud firewalls, zero-trust access governance, continuous vulnerability testing, and statutory incident response procedures under Section 8(5) of the DPDP Act, CERT-In directions, and global standards.
Data Fiduciary: BizLiveGo | Operator: MD Joshim Biswas | Malda, WB, India - 732206 | Version: 2026.1
This Data Security Policy defines the technical, operational, and organizational security controls implemented across BizLiveGo servers, edge nodes, dynamic QR code resolvers, and database clusters.
Our controls operationalize compliance under Section 8(5) of the Digital Personal Data Protection (DPDP) Act, 2023, the Information Technology (Cert-In Cyber Security Directions) Rules, and the GDPR (Article 32).
BizLiveGo engineers systems according to industry security best practices:
How BizLiveGo safeguards data across transmission pipelines and multi-tenant database clusters:
All web sessions, dynamic QR code scan resolvers, administrative dashboards, and API webhooks are forced over TLS 1.3 (with TLS 1.2 fallback) using modern cipher suites.
Automated HSTS (HTTP Strict Transport Security) preloading bars unencrypted HTTP access.
Primary application databases, object storage buckets containing uploaded media assets, and server backups are encrypted using enterprise AES-256 cryptographic algorithms.
Database volumes, tablespaces, and cold backup archives remain encrypted by default.
Cryptographic keys are managed through isolated Key Management Services with automated annual key rotation cycles, strict separation of duties, and tamper-proof hardware security module (HSM) backings.
Decryption keys are never stored on production application web servers.
The most effective security control is data minimization. BizLiveGo eliminates breach liability by enforcing an architectural ban on high-risk government identity documents:
Our platform never ingests, stores, or processes:
All payment checkouts execute inside secure iframes:
How our multi-layered network perimeter mitigates automated threats, exploits, and DDoS spikes:
Cloudflare Enterprise WAF:
Layer 3/4/7 protection:
Anti-abuse rate controls:
VPC segmentation:
Enforcing strict internal identity controls to mitigate insider threats and credential compromise:
Personnel access to server nodes and customer data stores is governed by strict Role-Based Access Control (RBAC) under the principle of Least Privilege. Access is granted on a documented, time-bounded need-to-know basis.
All administrative access to infrastructure management consoles, code repositories, cloud dashboards, and internal support panels mandates hardware-backed Multi-Factor Authentication (MFA).
Administrative actions, schema changes, and elevated privilege sessions generate tamper-evident audit logs streamed to isolated, append-only log repositories retained pursuant to statutory guidelines.
BizLiveGo maintains an active vulnerability management program designed to identify and remediate security weaknesses before exploitation:
Resilient recovery topologies prevent service loss and catastrophic database corruption:
BizLiveGo maintains a 24/7 Security Incident Response Plan (SIRP) to triage, contain, eradicate, and report cyber events:
Real-time automated alerting monitors unauthorized access attempts, mass file deletions, and abnormal egress traffic spikes. Affected nodes are automatically quarantined to prevent lateral movement.
In compliance with Indian cyber directives, verified cyber incidents (ransomware, unauthorized database exfiltration, system compromise) are reported to the Indian Computer Emergency Response Team (CERT-In) within statutory timeframes.
Where a security breach involves a risk of harm to Data Principals, notifications are dispatched to the Data Protection Board of India (DPBI) and impacted account holders without undue delay within 72 hours of verification.
Consolidated review of technical security baselines, encryption standards, and compliance metrics:
| Security Dimension | BizLiveGo Implementation Standard | Compliance Framework |
|---|---|---|
| Encryption in Transit | Mandatory TLS 1.3 across all profile views, QR resolvers, and administrative APIs. | OWASP / Section 8(5) DPDP |
| Encryption at Rest | AES-256 full volume and database encryption across primary and backup clusters. | FIPS 140-2 / ISO 27001 |
| Edge Perimeter Defense | Cloudflare Enterprise WAF, Layer 3/4/7 DDoS mitigation, and scraping rate limits. | Active 24/7 Edge Defense |
| Financial Security | Tokenized checkouts via certified PCI-DSS Level 1 partners (Razorpay, Stripe). | Zero Raw Card Storage |
| Prohibited Identifiers | National ID cards, passports, bank card CVVs, and passwords strictly barred. | Zero-Retention Rule |
| Administrative Access | Least privilege RBAC, hardware-backed MFA, and immutable audit logging. | Zero-Trust Governance |
| Critical Patch SLA | Critical CVEs remediated within 48 hours; high severity within 7 business days. | Vulnerability Cadence |
| Breach Notification SLA | Statutory notices to CERT-In / DPBI and impacted users without undue delay (within 72h). | CERT-In Directions / DPDP Act |
BizLiveGo values responsible vulnerability disclosure. If you discover a potential security flaw, technical misconfiguration, or suspect an unauthorized access event, notify our security office immediately.
Chief Security & Data Protection Officer: Joshim Biswas | Location: Masimpur, Kaliachak, Malda, West Bengal, India - 732206