Security

At Code Clue (HN Digital Education Private Limited), security is not an afterthought — it is built into every layer of our platform. We employ multiple technical, organizational, and procedural safeguards to protect user data, transactions, and platform integrity. This page outlines the measures we take and what you can do to help protect your account.

All data transmitted between your browser and our servers is encrypted using:

• TLS 1.2 / 1.3 (HTTPS): All web traffic is served over HTTPS. Our SSL certificates are auto-renewed and monitored 24/7.
• At-rest encryption: Sensitive data stored in our databases (passwords, payment tokens, personal data) is encrypted using AES-256.
• Hashed passwords: User passwords are never stored in plain text — they are hashed using bcrypt with salt rounds.

Code Clue does not store raw card numbers, CVVs, or banking credentials. All payment processing is handled by PCI-DSS compliant payment gateways:

• Razorpay (primary — India-based, RBI regulated)
• PayPal (international transactions)

UPI-based payments (including for the Digital Launch Kit) are processed directly through UPI infrastructure (NPCI) and our registered merchant account. Tokens returned by the payment gateway are stored only to reference transaction status.

Our platform is hosted on enterprise-grade cloud infrastructure with the following protections:

We apply the principle of least privilege — employees and systems only access data necessary for their specific role or function.

• Role-based access control (RBAC) enforced across all internal systems
• Multi-factor authentication (MFA) required for all team members with production access
• All admin actions are logged with timestamps and user attribution
• Access is revoked immediately upon employee offboarding
• Third-party vendor access is granted on a need-only, time-limited basis

Our development team follows secure coding practices, including:

• OWASP Top 10 vulnerability assessment in every major release
• Parameterized queries and ORM usage to prevent SQL injection
• Input validation and output sanitization across all user-facing forms
• Content Security Policy (CSP) headers to prevent XSS attacks
• Regular dependency audits using automated tools (npm audit, Snyk)
• CORS policies enforced on all API endpoints

In the event of a security incident or data breach, Code Clue follows a structured incident response plan:

1. Detection & Containment: Automated alerts trigger immediate investigation and isolation of affected systems
2. Assessment: Scope, impact, and root cause are determined within 24 hours
3. User Notification: Affected users are notified within 72 hours if their data is compromised
4. Regulatory Reporting: Relevant authorities are notified as required by law
5. Post-Incident Review: A root cause analysis and remediation plan is completed and documented

We encourage all users to take the following steps to protect their Code Clue account:

• Use a strong, unique password for your Code Clue account
• Enable two-factor authentication (2FA) when available
• Never share your login credentials with anyone, including Code Clue support staff
• Log out from shared or public devices after each session
• Be cautious of phishing emails — Code Clue will never ask for your password via email
• Report suspicious account activity immediately at security@codeclue.in

We take security vulnerabilities seriously. If you discover a security issue in our platform, we encourage responsible disclosure:

• Email your findings to security@codeclue.in
• Include a detailed description of the vulnerability and steps to reproduce it
• Do not exploit or publicly disclose the vulnerability before we have had a chance to fix it
• We will acknowledge your report within 48 hours and aim to resolve valid vulnerabilities within 30 days

We appreciate the security community's effort in keeping our platform safe and recognize responsible disclosures in our security acknowledgements.

Code Clue's security practices are aligned with the following standards and regulations:

• Information Technology Act, 2000 (India)
• IT (Reasonable Security Practices and Procedures) Rules, 2011
• Digital Personal Data Protection Act, 2023 (DPDPA)
• PCI-DSS (via Razorpay and PayPal payment gateways)
• GDPR-aligned practices for international users

For security-related concerns, vulnerabilities, or questions: