Your data, handled carefully.

Stored files (like rendered report PDFs) live in private cloud storage with server-side AES-256 encryption and no public access. Application secrets (database credentials, API keys, payment keys) are never stored in application code or config files — they're kept in a managed secrets store (AWS Secrets Manager, KMS-backed) and fetched at process start.

Every connection to Punji is served over HTTPS, with plain-HTTP requests automatically redirected. We enforce HSTS (HTTP Strict Transport Security) so browsers refuse to fall back to an insecure connection, plus standard hardening headers (Content-Security-Policy, X-Content-Type-Options) on our web-facing services.

Database queries use parameterized statements throughout, not string-built SQL. Payment webhooks are verified with signature checks before being trusted. Every endpoint that returns your data checks that the request actually belongs to your account before returning anything.

Application secrets are managed via a dedicated secrets service with scoped, least-privilege access — the servers that run Punji hold no long-lived cloud credentials of their own. Services run as non-root inside containers. Sensitive endpoints (login, file upload, payment webhooks) are individually rate-limited to blunt brute-force and abuse. Internal API documentation endpoints are disabled in production so our API surface isn't publicly browsable.

We don't yet run a formal automated CI/CD security gate (e.g. mandatory security checks blocking every merge) — this is an area we plan to formalize as the team and codebase grow. Security-relevant changes today go through internal review as part of normal engineering practice, not a separate certified process.

Yes, for our website infrastructure: Cloudflare's Security Insights automatically scans our hosting configuration on a weekly basis, checking for misconfigurations and known vulnerabilities. Our application (chat.punji.ai) does not yet have a continuous automated scanning program — it's reviewed on an on-demand basis today, and formalizing continuous scanning there is on our roadmap.

We conduct our own internal security reviews of the codebase and infrastructure as the platform evolves, and fix what we find as part of normal engineering. Some of the best independent security researchers available in India have taken a pass at our application and found it satisfactory — we plan to engage them on a regular basis going forward as the platform matures.

If you believe you've found a security issue in Punji, please email us at support@cloudoptics.io with the subject line "Security Disclosure" and enough detail to reproduce it. We ask that you give us a reasonable window to investigate and fix the issue before any public disclosure, and that you avoid accessing, modifying, or retaining any data that isn't your own while testing. We don't currently offer a paid bug bounty program, but genuine, responsibly-disclosed reports are welcome and appreciated — with your permission, we're happy to publicly credit researchers here once we've had real reports to credit.

Not yet — we haven't had a disclosure to credit. Once we do (and with the reporter's permission), we'll list their name here as a thank-you. No bounty payments are promised; public credit is the extent of the program today.