Security Policy

OrbitSub, a sole proprietorship owned and operated by Karan in New Delhi, India, and registered as a micro enterprise under the Udyam (MSME) scheme of the Government of India ("OrbitSub", "we" or "us") takes the security of your Account and data seriously. This Security Policy describes the reasonable security practices and procedures we maintain, as required by the Information Technology Act, 2000, the SPDI Rules and the Digital Personal Data Protection Act, 2023. It forms part of our Privacy Policy.

1. Protecting your Account

1. Passwords are stored only as one-way cryptographic hashes using bcrypt. We cannot see your password, and we will never ask you for it by email or message.
2. Two-factor authentication is available to every user, using an authenticator app, with single-use backup codes.
3. Sessions use short-lived access tokens and a refresh token kept in a secure, HttpOnly cookie that scripts in the page cannot read.
4. Email verification confirms that you control the email address on your Account.
5. Sign-in protection includes rate limiting of authentication attempts and bot protection by Cloudflare Turnstile.

2. Protecting data

1. In transit: connections to the Service are encrypted using TLS.
2. Access control: access to personal data is limited to what is needed to operate and support the Service, and to our proprietor and service providers bound by confidentiality.
3. Application security: the Service validates input, sets security headers that restrict what browsers may load, and rate-limits requests.
4. Providers: we use established infrastructure providers for hosting, database, file storage and email, and we choose providers that maintain recognised security practices.
5. Payments: payment details are handled by PayPal. We never receive or store card or bank account numbers.
6. Monitoring and backups: we monitor the Service for errors and abuse, and keep backups so that data can be recovered after a failure.

3. Incident response

If we become aware of a security incident affecting personal data, we will act promptly to contain it, investigate it and reduce its impact. Where required by law, we will:

1. report cyber security incidents to the Indian Computer Emergency Response Team (CERT-In) within six hours of becoming aware of them;
2. inform affected users without undue delay, describing what happened, its likely consequences, the steps we are taking and what they can do;
3. notify the Data Protection Board of India, including a detailed report within 72 hours;
4. notify any other regulator whose notification rules apply.

4. What you can do

1. Use a strong, unique password, and enable two-factor authentication.
2. Keep your backup codes somewhere safe.
3. Be careful with emails or messages asking you to sign in or share codes. Emails from us come from our orbitsub.com domain.
4. Sign out on shared devices.
5. Tell us immediately at team@orbitsub.com if you notice any activity on your Account that you do not recognise.

5. Reporting a vulnerability

If you believe you have found a security vulnerability in the Service, please report it under our Responsible Disclosure Policy.

6. Limits

No method of transmission or storage is completely secure. While we work hard to protect your data, we cannot guarantee absolute security.

This Policy is effective from 1 October 2026.