SECURITY & DATA PROTECTION POLICY
Our multi-layered security architecture, bank-grade payment encryption, and strict data governance policies protecting your estate coffee orders.
Status: Fully Enforced • TLS 1.3 Active • PCI-DSS Level 1 Compliant
256-Bit SSL/TLS
Every request is encrypted in transit using TLS 1.3 with automated HSTS preloaded headers.
Zero Card Storage
Card numbers, UPI PINs, and banking credentials are never stored or processed on our servers.
Edge Protection
Google Cloud global CDN edge firewalling with automated DDoS and bot attack mitigation.
1. TRANSPORT & INFRASTRUCTURE SECURITY
All communications between your browser and coorgcoffees.in are encrypted using HTTPS with TLS 1.3 protocol suites. We implement Strict-Transport-Security (HSTS) with a 1-year max-age directive and subdomains inclusion, guaranteeing that no traffic is ever downgraded to unencrypted HTTP.
- Automatic SSL/TLS certificate rotation and certificate transparency monitoring.
- Global Content Delivery Network (CDN) with geographic edge caching and instant DDoS filtering.
- Cloud Firestore security rules validating data schemas, value ranges, and rejecting unauthorized mutations.
2. RAZORPAY PAYMENT & PCI-DSS COMPLIANCE
Payment processing is handled exclusively through Razorpay Software Private Limited, a PCI-DSS Level 1 certified payment aggregator regulated by the Reserve Bank of India (RBI).
- Zero Credential Storage: Coorg Coffee never receives, stores, or handles credit/debit card numbers, CVVs, expiry dates, or UPI PINs.
- Tokenization: Card payments use tokenized cryptograms compliant with RBI tokenization guidelines.
- Cryptographic Verification: All payment receipts are verified server-side using HMAC-SHA256 signature validation before order confirmation.
3. BROWSER SECURITY & XSS DEFENSES
We deploy strict HTTP security headers designed to thwart common web application threats:
- Content Security Policy (CSP): Restricts executable script sources to approved origins, preventing unauthorized inline code execution.
- X-Content-Type-Options: nosniff: Instructs browsers to reject MIME-type confusion attacks.
- X-Frame-Options: SAMEORIGIN / DENY: Blocks clickjacking and unauthorized embedding of pages in external frames.
- Automated Input Sanitization: All user-submitted text (product reviews, contact requests, address notes) undergoes regex-based HTML/script stripping before storage.
4. ADMINISTRATIVE ACCESS & AUDITABILITY
Our administrative portal operates under strict isolation:
- Domain Isolation: The administration console is hosted on a separate authenticated domain, preventing storefront cross-context leakage.
- Brute-Force Rate Limiting: Repeated invalid login attempts trigger automated progressive lockout periods.
- Immutable Audit Logging: Administrative actions (stock changes, price updates, order statuses) are recorded with timestamps, actor IDs, and delta diffs.
5. RESPONSIBLE VULNERABILITY DISCLOSURE
We welcome responsible security research. If you believe you have discovered a vulnerability affecting our services, please report it to our engineering team at security@coorgcoffee.in or through our Contact Desk.
Please include detailed reproduction steps, HTTP requests/responses, and allow us reasonable time to remediate before public disclosure.