RANAPAY INDIA PRIVATE LIMITED

This Policy establishes the information-security and cyber-security governance framework for protecting RanaPay's systems, applications, APIs, customer information, transaction data, business records and technology services against unauthorised access, misuse, alteration, disclosure, disruption and other security threats.

• Protect confidentiality, integrity and availability of information.
• Reduce cyber and information-security risk.
• Maintain secure systems and applications.
• Protect customer and transaction information.
• Support secure partner integrations.
• Detect and respond to security incidents.
• Meet applicable legal, contractual and regulatory requirements.

This Policy applies to employees, contractors, consultants, systems, applications, APIs, cloud services, endpoints, networks, databases, third-party services and other technology resources used for RanaPay business activities.

• Need-to-know access
• Least privilege
• Secure-by-design
• Defence in depth
• Data minimisation
• Accountability and logging
• Regular review and improvement

• Public
• Internal
• Confidential
• Restricted / Sensitive

Information shall be classified according to business impact, sensitivity, legal requirements and risk. Access and handling controls shall reflect the classification.

Technology and information assets shall be identified and maintained in an appropriate inventory. Ownership and responsibility shall be assigned for critical systems and data.

Access shall be granted based on business need and least privilege. User access shall be approved, periodically reviewed and revoked when no longer required.

• Strong passwords where passwords are used
• Multi-factor authentication for appropriate privileged or sensitive access
• Secure credential storage
• No credential sharing
• Prompt revocation of compromised credentials

Administrative and privileged access shall be restricted, separately controlled where practicable, logged and periodically reviewed.

• Approved devices and software
• Security updates
• Malware protection where appropriate
• Screen/device protection
• Restricted removable media
• Secure disposal

Networks and infrastructure shall use appropriate segmentation, firewalls, secure configurations, encryption and monitoring based on risk.

• Secure development practices
• Code review where appropriate
• Vulnerability assessment/testing
• Input validation
• Secure error handling
• Dependency management
• Production access restriction

APIs shall use appropriate authentication, authorisation, encryption, rate limiting, input validation, logging and monitoring. API credentials shall be protected and rotated according to risk.

Confidential and sensitive information shall be protected against unauthorised access, disclosure, alteration and destruction using appropriate technical and organisational controls.

Encryption shall be used for sensitive information in transit and, where appropriate based on risk and system design, at rest. Cryptographic keys shall be protected and access restricted.

• Authentication events
• Privileged activity
• Transaction/API activity where relevant
• Security alerts
• System errors
• Administrative changes

Logs shall be protected against unauthorised modification and retained according to applicable requirements.

1. Identify vulnerabilities.
2. Assess severity and business impact.
3. Prioritise remediation.
4. Apply patches or compensating controls.
5. Validate remediation.
6. Record closure.

Security and system changes shall be tested and approved through appropriate change-management procedures. Emergency changes shall be documented and reviewed after implementation.

Critical information and systems shall have appropriate backup and recovery arrangements consistent with the Business Continuity & Disaster Recovery Policy.

Suspected cyber incidents shall be reported and managed under the Cyber Incident Response & Cyber Fraud Policy. Evidence shall be preserved and relevant stakeholders escalated according to severity.

Personnel shall receive awareness guidance regarding phishing, malicious links, impersonation, credential theft, OTP scams and other social-engineering risks.

Third parties with access to RanaPay systems or information shall be subject to appropriate due diligence, contractual security requirements, access controls and monitoring under the Third-Party / Vendor Risk Management Policy.

Cloud and hosting environments shall be configured according to security requirements, with appropriate identity controls, network restrictions, logging, backups and vulnerability management.

Remote access to business systems shall use approved secure mechanisms and appropriate authentication. Access shall be restricted based on business need.

Devices, media and information shall be securely disposed of or sanitised when no longer required, taking account of information sensitivity and applicable retention obligations.

• Protect credentials
• Use approved systems
• Report suspicious activity
• Do not install unauthorised software
• Follow access and data-handling procedures
• Complete required security training

Relevant personnel shall receive periodic information-security and cyber-security awareness training appropriate to their role.

RanaPay may conduct vulnerability assessments, security reviews, configuration reviews, penetration testing or other testing appropriate to the risk and criticality of systems.

Security concerns shall be reported promptly through designated internal channels. Personnel shall not conceal suspected security incidents.

Personal and customer data shall be processed and retained according to applicable requirements and RanaPay's Data Protection, Privacy & Retention Policy.

Critical technology services shall have continuity and recovery arrangements proportionate to their business impact and shall be covered by the Business Continuity & Disaster Recovery Policy.

Security controls may be reviewed through internal assessments, partner audits, external assessments or other assurance activities. Identified deficiencies shall be tracked to remediation.

Security exceptions shall be documented, risk-assessed, time-bound where appropriate and approved by an authorised person. Exceptions shall not be used to bypass mandatory legal or contractual requirements.

This Policy shall be reviewed at least annually and whenever there is a material change in technology, cyber risk, business operations, partner requirements or applicable law.