Security Policy

1. Commitment to Security

TryGetBill is committed to protecting the security, integrity, and confidentiality of user data. This Security Policy describes the technical and organizational measures we implement to safeguard the TryGetBill platform and the data processed through it.

While no system is 100% immune to security threats, we follow industry best practices and leverage enterprise-grade cloud infrastructure to minimize risk.

2. Infrastructure Security

2.1 TryGetBill is built on Google Firebase and Google Cloud Platform (GCP) infrastructure. GCP data centers maintain the following certifications: ISO 27001, ISO 27017, ISO 27018, SOC 1, SOC 2, SOC 3, and PCI DSS.

2.2 Infrastructure security measures include:

• All communications encrypted via HTTPS with TLS 1.2 or higher. Unencrypted HTTP connections are not accepted
• Firebase Hosting with automatic SSL/TLS certificate management
• Content Security Policy (CSP) headers restricting executable content sources to trusted domains only
• HTTP Strict Transport Security (HSTS) enforced
• X-Frame-Options, X-Content-Type-Options, and Referrer-Policy security headers configured
• Firebase App Check with reCAPTCHA v3 provider for bot detection and API abuse prevention
• Google Cloud's DDoS protection and network-level security

3. Data Encryption

3.1 Encryption in transit:

• All data transmitted between users and TryGetBill is encrypted using TLS 1.2+ (HTTPS)
• All internal communications between Firebase services use encrypted channels
• Payment data flows between users and Razorpay are encrypted by Razorpay's PCI-DSS Level 1 compliant infrastructure

3.2 Encryption at rest:

• All data stored in Firebase Firestore is encrypted at rest using AES-256 encryption as provided by Google Cloud Platform
• All files in Firebase Storage (including invoice PDFs) are encrypted at rest using AES-256
• Encryption keys are managed by Google Cloud's Key Management Service (KMS)

4. Authentication & Access Control

4.1 User authentication:

• Authentication is handled via Firebase Authentication using Google OAuth 2.0
• TryGetBill does not store passwords. Authentication is delegated entirely to Google's secure infrastructure
• Session persistence is controlled based on cookie consent: full persistence for consenting users, session-only persistence otherwise
• Firebase App Check tokens are required for all authenticated API calls

4.2 Data access control:

• Firestore Security Rules enforce document-level access control. Users can only read and write their own data
• Firebase Storage Rules restrict file access to the authenticated owner
• Cloud Functions implement server-side authorization checks and rate limiting
• Admin-level operations (blog management, coupon creation) require specific role assignments in the database

4.3 Internal access:

• Access to Firebase console, Google Cloud console, and production databases is restricted to authorized personnel only
• Administrative access requires multi-factor authentication
• Access is granted on a least-privilege basis and reviewed periodically
• All administrative actions are logged

5. Application Security

5.1 Secure development practices:

• Input validation and sanitization on both client and server side
• Protection against common web vulnerabilities including XSS (Cross-Site Scripting), CSRF (Cross-Site Request Forgery), and injection attacks
• Content Security Policy headers restricting script execution to trusted sources
• Regular dependency updates and automated vulnerability scanning
• Server-side rate limiting on sensitive operations (account creation, invoice creation, payment verification)

5.2 API security:

• All Firebase Cloud Functions require authenticated requests with valid Firebase Auth tokens
• App Check enforcement prevents unauthorized API calls from non-verified clients
• Razorpay webhook endpoints verify request signatures to prevent spoofing
• Rate limiting prevents abuse of callable functions

6. Payment Security

6.1 All payment processing is handled by Razorpay (Razorpay Software Private Limited), which is PCI-DSS Level 1 compliant and RBI-licensed.

6.2 TryGetBill does not at any time collect, process, store, transmit, or have access to credit/debit card numbers, CVVs, UPI PINs, net banking passwords, or any sensitive payment credentials.

6.3 We receive only Razorpay Payment IDs and payment status for subscription verification purposes.

6.4 Payment verification is performed server-side via Razorpay's API with secret key authentication, never on the client side.

7. Incident Response Plan

In the event of a security incident, TryGetBill follows a structured incident response process:

• Detection & Identification: Continuously monitor for anomalous activity, unauthorized access attempts, and system alerts
• Containment: Immediately isolate affected systems, revoke compromised credentials, and prevent further unauthorized access
• Investigation: Conduct thorough forensic analysis to determine the scope, cause, and impact of the incident
• Notification: Notify affected users and the Data Protection Board of India (as required under the DPDP Act, 2023) within the legally prescribed timeframe. Notify CERT-In within 6 hours for qualifying incidents as required under the Cyber Security Directions, 2022
• Remediation: Implement fixes, patches, and security improvements to address the root cause
• Post-Incident Review: Document lessons learned and update security practices accordingly

8. Data Breach Response

8.1 In the event of a confirmed personal data breach, TryGetBill will:

• Notify the Data Protection Board of India as required under the DPDP Act, 2023
• Notify CERT-In within 6 hours of becoming aware of the breach, as required under CERT-In Cyber Security Directions dated April 28, 2022
• Notify affected Data Principals (users) without unreasonable delay, describing: the nature of the breach, categories and approximate number of records affected, likely consequences, and measures taken to address the breach
• Maintain detailed records of all data breaches, including facts, effects, and remedial actions taken

9. User Security Responsibilities

Security is a shared responsibility. Users are responsible for:

• Maintaining the security of their Google account used to sign in to TryGetBill, including using strong passwords and enabling 2FA on their Google account
• Not sharing login credentials, session tokens, or account access with unauthorized individuals
• Using secure, updated devices and browsers when accessing TryGetBill
• Avoiding use of public or unsecured Wi-Fi networks for sensitive operations
• Logging out of TryGetBill when using shared or public devices
• Reporting any suspicious activity, unauthorized access, or security concerns immediately to security@trygetbill.com

TryGetBill shall bear no liability for security breaches resulting from the user's failure to maintain adequate account security practices.

10. Responsible Disclosure Policy

10.1 TryGetBill welcomes responsible disclosure of security vulnerabilities. If you discover a security issue, please report it responsibly:

Email: security@trygetbill.com

10.2 When reporting, please include:

• A detailed description of the vulnerability
• Steps to reproduce the issue
• Potential impact assessment
• Any supporting evidence (screenshots, logs, proof of concept)

10.3 Guidelines for responsible disclosure:

• Do NOT exploit the vulnerability beyond what is minimally necessary to demonstrate its existence
• Do NOT access, modify, or delete other users' data
• Do NOT publicly disclose the vulnerability before TryGetBill has had reasonable time to address it (minimum 90 days)
• Do NOT conduct denial-of-service attacks, social engineering, or physical security tests

10.4 TryGetBill will acknowledge receipt of vulnerability reports within 48 hours and provide updates on remediation progress. We will not take legal action against researchers who follow this responsible disclosure policy in good faith.

11. Compliance

TryGetBill's security practices are designed to comply with applicable Indian laws and regulations including:

• Information Technology Act, 2000
• Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011
• Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021
• Digital Personal Data Protection Act, 2023
• CERT-In Cyber Security Directions, 2022

12. Limitation of Liability

While TryGetBill implements commercially reasonable security measures, no platform can guarantee absolute security. TryGetBill shall not be liable for any unauthorized access, data breach, or security incident caused by: force majeure events; vulnerabilities in third-party services (Google, Firebase, Razorpay); user negligence in maintaining account security; or zero-day vulnerabilities that could not have been reasonably anticipated or prevented.

13. Changes to This Policy

TryGetBill may update this Security Policy at any time. Significant changes will be posted on this page with a revised effective date. For material changes affecting data processing, registered users will be notified via email.

14. Contact

For security concerns, vulnerability reports, or questions about this policy:

Security: security@trygetbill.com

General support: support@trygetbill.com