Security Policy

• The website runs on Amazon Web Services: AWS Amplify Hosting behind the Amazon CloudFront network, with the database on Amazon RDS for PostgreSQL.
• Traffic to the website passes through an AWS WAF web application firewall, and CloudFront carries AWS Shield Standard protection against common network-level denial-of-service attacks.

• Connections to the website use HTTPS, with TLS 1.3 supported.
• The application connects to its database over TLS, and the database refuses unencrypted connections.
• The database and its automated backups are encrypted at rest with AWS-managed keys (AES-256).

• The website reaches its database through a restricted account that can only read and write the application’s own data; it cannot change the database structure or manage other accounts.
• Administrative pages and actions are limited to accounts with the administrator role, checked on the server for every request.
• Multi-factor authentication is enabled on the cloud provider’s root account.

• Only necessary data is collected, and we never share or sell it without consent or legal requirement.
• Users have the right to request access, correction, or deletion of their personal data at any time.

• Online payments and paid packages are not currently available through the Aarvasa website, and no payment gateway is connected to it.
• The website does not collect or store card, UPI or bank account details.

• The database is still reachable from the internet (protected by its restricted account, enforced TLS and strong credentials); moving it onto a private network is scheduled.
• Centralised audit logging and automated threat detection are not yet enabled; they are planned.
• To report a security issue, please use the contact page.

We adhere to all applicable data protection laws including the Indian IT Act and GDPR for global users.