Security Policy.

1. Purpose

This Security Policy describes the administrative, technical and organizational measures implemented by ARZAQ INSIGHTS to protect the Arzavo platform and customer information.

2. Infrastructure

Arzavo is hosted on Amazon Web Services (AWS) infrastructure in the Mumbai (India) region. Infrastructure components are monitored and maintained to support availability, reliability and security.

3. Tenant Isolation

Each educational institution operates within its own isolated tenant database. Tenant data is logically separated to reduce the risk of unauthorized cross-tenant access.

4. Access Control

Access to administrative systems is restricted to authorized personnel with a legitimate business need. Authentication controls and permission management are used to limit access.

5. Authentication

Users are responsible for protecting their credentials. Institutions should assign appropriate roles and promptly remove access for users who no longer require it.

6. Encryption

Industry-standard encryption is used where appropriate to protect data in transit. Sensitive information is protected using suitable security controls.

7. Monitoring & Logging

Security events, authentication activity and operational logs may be recorded to detect suspicious activity, investigate incidents and improve platform security.

8. Backup & Disaster Recovery

Regular backups are maintained to support disaster recovery and business continuity. Backup retention and restoration follow internal operational procedures.

9. Vulnerability Management

ARZAQ INSIGHTS may periodically review infrastructure, software dependencies and platform components to identify and remediate security vulnerabilities.

10. Incident Response

Suspected security incidents are investigated promptly. Where appropriate, affected customers may be notified in accordance with applicable law and operational requirements.

11. Customer Responsibilities

• Use strong passwords.
• Protect account credentials.
• Assign user permissions responsibly.
• Keep contact information up to date.
• Report suspected security issues immediately.

12. Responsible Disclosure

Security researchers who identify a potential vulnerability are encouraged to report it responsibly to support@arzavo.com. Please do not exploit or publicly disclose vulnerabilities before allowing reasonable time for investigation.

13. Policy Updates

This policy may be revised from time to time to reflect improvements in security practices or changes in legal requirements.