1. Purpose

This Security & Data Protection Policy describes the technical and organisational measures Hottrix IT Services Private Limited ("HOTTRIX") applies to HOTTRIX CHAT (the "Service"). It describes controls that are actually implemented in the Service; it does not describe aspirational or planned controls, and it does not claim certifications that do not apply.

2. Multi-Tenant Isolation

Each Company is provisioned as a separate tenant. Every request that touches Company data (conversations, messages, files, calls, attendance, leave, payroll, and related records) is filtered server-side against the authenticated user's own Company — never against a value supplied by the browser. Conversation membership, group membership, manager-employee relationships, and file-download access are each independently verified to belong to the same Company before any data is returned.

3. Authentication and Session Security

• Passwords are stored only as salted cryptographic hashes (via PHP's password hashing functions) — never in plain text or reversible form.
• Sessions use HTTP-only, SameSite-restricted cookies, marked Secure when served over HTTPS, and the session identifier is regenerated on login to reduce session-fixation risk.
• Repeated failed login attempts trigger a temporary account lockout.
• Separate login entry points exist for the Super Admin role and for Company users, and the Super Admin role is not exposed in the ordinary employee login flow.

4. Access Control

The Service implements role-based access control across five roles (Super Admin, Company Admin, HR, Manager, Employee), each enforced on the server for every page and API request — not merely hidden in the user interface. For example, a Manager can only view or act on leave requests from users who report to them; HR access to leave approvals without an assigned manager is governed by a Company-level setting; and Company Admin actions are scoped strictly to that Company.

5. Application-Layer Protections

• CSRF protection: state-changing requests require a per-session token that is verified using constant-time comparison.
• SQL injection protection: all database queries use parameterised/prepared statements.
• Cross-site scripting (XSS) protection: user-supplied content is escaped before being rendered in the browser.
• File upload validation: uploaded files are validated by inspecting their actual file content (not merely the filename or the browser-supplied type), checked against an allow-list of permitted file types, stored under randomly generated filenames outside of any directly browsable location, and subject to per-category size limits.
• Authenticated file access: uploaded files are served only through an authenticated endpoint that re-verifies the requester is a participant of the relevant conversation and belongs to the same Company as the file, on every download.

6. Audit Logging

Significant administrative actions — including company creation/suspension, license changes, user creation/disablement, manager assignment, leave approval/rejection, and payroll calculation/finalisation — are recorded in an audit log for accountability. Passwords and license tokens are never written to the audit log.

7. Voice and Video Calls

Voice and video call media is transmitted directly between participants' devices and is not recorded or stored by the Service, as described in the Voice & Video Calling Policy.

8. Data Deletion

Where a Company is deleted from the platform (a deliberate, explicitly confirmed action available only to the Super Admin), the Company's users, conversations, messages, files, calls, attendance, leave, and payroll records are removed accordingly.

9. ISO/IEC 27001

Hottrix IT Services Private Limited maintains an ISO/IEC 27001 certified Information Security Management System.

10. What This Policy Does Not Claim

The Service does not implement, and this Policy does not claim, end-to-end encryption, zero-knowledge encryption, SOC 2 certification, HIPAA compliance, GDPR certification, CERT-In certification, government certification, or "military-grade" encryption. HOTTRIX does not independently guarantee automated data backups or continuous security monitoring as a feature of the Service; Customers who require such capabilities should discuss their specific requirements with HOTTRIX directly.

11. Hosting Environment

The Service is designed to be operated over HTTPS in production. Deployment-level protections (such as TLS/HTTPS configuration and server hardening) are the responsibility of whichever party operates the production hosting environment for a given deployment, consistent with the parties' commercial arrangement.

12. Reporting a Security Concern

Security concerns can be reported to Hottrix IT Services Private Limited at info@hottrix.in.