# Security and Vulnerability Disclosure

Hold us to our own advice. How to report a vulnerability to us and what we promise in return, and how we look after Prayog One, client data and this website.

## Report a vulnerability

If you think you have found a security issue in anything we run, email security@prayog.tech. We read every report and would much rather hear from you than not.

### What to send

- the address or part of the product affected
- the steps to reproduce it
- what an attacker could do with it
- how you would like to be credited, if at all

We do not publish an encryption key yet. If the details are sensitive, say so in a first email and we will arrange a secure way to share them. Do not include personal data you came across beyond what is needed to show the issue.

### In scope

- prayog.tech and its subdomains that we run
- Prayog One, once it launches. Design partners report through the channel in their agreement

### Out of scope

- services we use but do not run, such as Cloudflare, Web3Forms, hCaptcha and Zoho; report those to their owners
- denial-of-service tests, spam, social engineering and physical attacks
- high-volume automated scanning
- reports from scanners alone, such as missing best-practice headers, with no way to exploit them

### While you test

- do not access, change or delete data that is not yours; if you reach personal or client data, stop and tell us
- do only what you need to show the issue
- keep the details to yourself until we have fixed it, or for 90 days after your report, whichever comes first

### What we promise

- **A reply.** We acknowledge your report within 5 working days and tell you whether we can reproduce it.
- **Updates.** We keep you told how the fix is going, and tell you when it is done.
- **No legal action.** If you act in good faith and follow this policy, we will not take legal action against you or report you to the authorities for your research. We cannot give permission to test systems that belong to others.
- **Credit.** With your permission, we credit you on this page once the issue is fixed. We do not run a paid bug bounty.

Security contact: security@prayog.tech · https://prayog.tech/.well-known/security.txt

## Prayog One: Agents propose. People approve.

Prayog One uses AI where judgement helps and plain, deterministic automation everywhere else. Every draft an agent writes is labelled as one until a person accepts it.

- **Nothing changes without approval.** Fixes arrive as reviewable pull requests or approved actions. You can switch agents off and the platform still works.
- **Read-only by construction.** Collectors read configuration and logs. They cannot change your systems.
- **A database for every client.** Each client's data sits in its own database, never shared with another tenant.
- **India first.** Compute and data are built to run in India first, with other regions added as clients need them.
- **Evidence you can prove.** Evidence is dated, hashed and kept in an append-only store, so an auditor can see it has not been altered.
- **Never the auditor.** Prayog One supports audits. It never issues attestations or certificates; independent auditors do.

### One fix, start to finish

1. Collector: Read identity provider settings (Done)
2. Check: PCAF-IAM-004 · 3 admin accounts without MFA (Failing)
3. Agent: Proposed: enforce MFA for the 3 accounts (AI draft)
4. Reviewer: Approved by the security lead (Done)
5. Evidence: MFA status saved · sha256 9f2c…41ab (Done)
6. Check: PCAF-IAM-004 passing · counts towards ISO 27001 and SOC 2 (Passing)

Prayog One is pre-launch. These describe how the platform is designed and built.

## Client data: Engagement data is handled the way we would advise you to.

- **Agreement first.** We sign a non-disclosure agreement and agree the scope in writing before we touch any system.
- **Only the access we need.** We ask for the least access the work needs, read-only wherever it will do, and remind you to remove it when we finish.
- **Kept encrypted.** Findings, reports and anything we collect stay encrypted on our own managed devices, shared only with the people you name.
- **Deleted when done.** Within 30 days of the engagement ending we delete working data and confirm it in writing. We keep the final report for our records.

## This website: We hold this site to the standard we would set for you.

- **HTTPS only.** Every page is served over HTTPS, and browsers are told never to connect without it.
- **A strict content policy.** Browsers may run only the site's own scripts and those of the few services named on our privacy notice. Each page lists its inline scripts by hash.
- **No trackers.** No advertising or tracking scripts, and fonts are served from the site itself, not a third party.
- **Little to attack.** The site is static. There is no database or login behind it, and the contact form is protected by hCaptcha.

Privacy notice: https://prayog.tech/privacy