Security

Hold us to our own advice.

How to report a vulnerability to us and what we promise in return, and how we look after Prayog One, client data and this website.

Vulnerability disclosure

Report a vulnerability

If you think you have found a security issue in anything we run, email security@prayog.tech. We read every report and would much rather hear from you than not.

security@prayog.tech

What to send

  • the address or part of the product affected
  • the steps to reproduce it
  • what an attacker could do with it
  • how you would like to be credited, if at all

We do not publish an encryption key yet. If the details are sensitive, say so in a first email and we will arrange a secure way to share them. Do not include personal data you came across beyond what is needed to show the issue.

In scope

  • prayog.tech and its subdomains that we run
  • Prayog One, once it launches. Design partners report through the channel in their agreement

Out of scope

  • services we use but do not run, such as Cloudflare, Web3Forms, hCaptcha and Zoho; report those to their owners
  • denial-of-service tests, spam, social engineering and physical attacks
  • high-volume automated scanning
  • reports from scanners alone, such as missing best-practice headers, with no way to exploit them

While you test

  • do not access, change or delete data that is not yours; if you reach personal or client data, stop and tell us
  • do only what you need to show the issue
  • keep the details to yourself until we have fixed it, or for 90 days after your report, whichever comes first

What we promise

  • A reply

    We acknowledge your report within 5 working days and tell you whether we can reproduce it.

  • Updates

    We keep you told how the fix is going, and tell you when it is done.

  • No legal action

    If you act in good faith and follow this policy, we will not take legal action against you or report you to the authorities for your research. We cannot give permission to test systems that belong to others.

  • Credit

    With your permission, we credit you on this page once the issue is fixed. We do not run a paid bug bounty.

Prayog One

Agents propose. People approve.

Prayog One uses AI where judgement helps and plain, deterministic automation everywhere else. Every draft an agent writes is labelled as one until a person accepts it.

  • Nothing changes without approval

    Fixes arrive as reviewable pull requests or approved actions. You can switch agents off and the platform still works.

  • Read-only by construction

    Collectors read configuration and logs. They cannot change your systems.

  • A database for every client

    Each client's data sits in its own database, never shared with another tenant.

  • India first

    Compute and data are built to run in India first, with other regions added as clients need them.

  • Evidence you can prove

    Evidence is dated, hashed and kept in an append-only store, so an auditor can see it has not been altered.

  • Never the auditor

    Prayog One supports audits. It never issues attestations or certificates; independent auditors do.

One fix, start to finish

  1. CollectorRead identity provider settingsDone
  2. CheckPCAF-IAM-004 · 3 admin accounts without MFAFailing
  3. AgentProposed: enforce MFA for the 3 accountsAI draft
  4. ReviewerApproved by the security leadDone
  5. EvidenceMFA status saved · sha256 9f2c…41abDone
  6. CheckPCAF-IAM-004 passing · counts towards ISO 27001 and SOC 2Passing

Prayog One is pre-launch. These describe how the platform is designed and built.

Client data

Engagement data is handled the way we would advise you to.

  • Agreement first

    We sign a non-disclosure agreement and agree the scope in writing before we touch any system.

  • Only the access we need

    We ask for the least access the work needs, read-only wherever it will do, and remind you to remove it when we finish.

  • Kept encrypted

    Findings, reports and anything we collect stay encrypted on our own managed devices, shared only with the people you name.

  • Deleted when done

    Within 30 days of the engagement ending we delete working data and confirm it in writing. We keep the final report for our records.

More about us

This website

We hold this site to the standard we would set for you.

  • HTTPS only

    Every page is served over HTTPS, and browsers are told never to connect without it.

  • A strict content policy

    Browsers may run only the site's own scripts and those of the few services named on our privacy notice. Each page lists its inline scripts by hash.

  • No trackers

    No advertising or tracking scripts, and fonts are served from the site itself, not a third party.

  • Little to attack

    The site is static. There is no database or login behind it, and the contact form is protected by hCaptcha.

Privacy notice