Signin Signup
Sign In Sign Up
Corporate Information Security Policy · ISO/IEC 27001 aligned · effective 6 July 2026

The controls behind the platform , written down.

Structurally aligned with ISO/IEC 27001, the Information Technology Act, 2000 and the RBI cyber-security guidelines. It applies to every employee, director, vendor, consultant and third-party infrastructure participant — not only to the engineering team.

Report a vulnerability
5
Foundational security principles
4
Data classification tiers
256-bit
AES, in transit and at rest
1×/mo
Access map compliance review
1×/day
Automated encrypted backups
1×/yr
Awareness training and policy review
Foundational principles

Five principles every control is built on

The primary objective is a secure environment for processing digital recharges and utility payments — with controls designed to mitigate risks, maintain business continuity, prevent network fraud and fulfil statutory legal reporting obligations.

1Least Privilege routing
2Need-to-Know data isolation
3Defence in Depth
4Continuous Security Telemetry
5Secure by Design lifecycles
Data classification

Four tiers, four levels of protection

The scope spans all corporate datasets, source code repositories, transaction database entries, KYC validation metadata, internal office networks and cloud computing zones — routed through an internal classification taxonomy.

1

Public

Marketing content, website textual copies and public corporate announcements.

2

Internal

Standard operating procedures, company internal reports and general workflow sheets.

3

Confidential

Customer and merchant account logs, transaction ledger summaries, payment gateway signatures and API partner technical documents.

4

Restricted and secret

Administrative login credentials, operational encryption keys, production system access tokens, infrastructure secrets, database passwords and private cryptographic certificates.

Access and encryption

Who can reach what, and how it is protected

Access control and authentication

Role-Based Access Control is enforced strictly. Privileges to staging or live production environments are granted only where required for job execution.

  • Monthly compliance reviewsAll employee access maps are reviewed every month, and tokens are deactivated immediately on a role change or separation.
  • Secure mobile verificationApplication-level verification alongside transactional MPIN requirements.
  • Mandatory MFAMulti-Factor Authentication on all administrative portals and developer panels.
  • Brief idle timeoutsAutomated server sessions expire quickly to block unauthorised device reuse.
  • Password constraintsStaff are prohibited from reusing passwords across internal tools, sharing credentials or writing keys down. Administrative systems enforce stricter automated complexity checks and forced rotation cycles.

Transport and storage encryption

Protecting data both in transit and at rest.

  • 256-bit AES and TLSAdvanced Encryption Standard protocols with Transport Layer Security pipelines throughout.
  • Hardware security modulesCryptographic keys protected using automated HSMs and key management solutions, so raw financial structures stay unreadable to outside nodes.
  • WORM audit logsAdministrative logins, database modifications, failed connection paths, threat alerts and API responses are written to write-once-read-many storage zones to block alteration.
Infrastructure and software

How the platform itself is built and defended

Secure development lifecycle

CLAUSE 10

All software, API code and platform updates follow secure coding frameworks including the OWASP Top 10. Development requires isolated code review gates, automated dependency scanning, vulnerability testing, and strict separation between staging and production databases.

Infrastructure defences

CLAUSE 11

Multi-tiered web application firewalls, network segmentation isolating financial environments from public web portals, automated system patch scheduling, and continuous vulnerability assessment scanning (VAPT).

Logging and monitoring

CLAUSE 12

Administrative logins, database modifications, failed connection paths, threat alerts and system API responses are all logged, into WORM storage zones that block unauthorised alteration.

Incident mitigation

CLAUSE 13

Where a threat matrix flags an anomaly — a DDoS attack, system intrusion or bulk account data calls — security incident handlers isolate affected nodes, block malicious source IPs, freeze target Coin balances, and share necessary security details with cyber networks such as CERT-In.

Continuity and backups

CLAUSE 14

The platform runs daily automated backups. Snapshots are encrypted, replicated across separate cloud zones, and tested regularly to confirm quick restore times.

Third-party vendor security

CLAUSE 15

All payment clearing gateways, API vendors and third-party tools must contractually prove their security systems match or exceed Anpay's baselines. They undergo routine risk reviews before accessing any internal dataset.

Security awareness

CLAUSE 16

All personnel accessing Anpay's data layers must complete security awareness and data handling training on onboarding, with refresher sessions every calendar year.

Periodic policy review

CLAUSE 17

This document undergoes automated security management and legal review cycles every year, to stay aligned with technological updates, new banking regulations and shifting cyber threat patterns.

Accountability

A shared responsibility

VD
Vaskar Das
Founder & Director

The security policy applies to directors as strictly as to engineers.

"Information security is a shared corporate responsibility. A control only one team follows is not a control."

Anpay is committed to protecting the confidentiality, absolute system integrity and high operational availability of data routing across its fintech and billing platforms — safeguarding customer profiles, transaction records, developer APIs, cloud infrastructures, Android and iOS configurations and administrative systems against unauthorised intrusion, data breaches or cyber disruptions.

We are committed to protecting our customers, merchants and digital payment infrastructure through strong administrative, technical and organisational security controls, while continuously improving our defensive systems against evolving digital risks.

Effective 6 July 2026ISO/IEC 27001 alignedIT Act 2000RBI cyber-security guidelinesOWASP Top 10
Report a vulnerability or incident

Found something? Tell us early.

Security reports reach the compliance bureau directly. Include enough detail to reproduce what you saw.

Corporate statutory coordinates

Legal titleAnpay Ventures Private Limited
CINU63990WB2024PTC272006
GSTIN19ABBCA0218R1ZH
Registered office1st Floor, Narayanpur, Kumarganj, Balurghat, Dakshin Dinajpur, India
Effective date6 July 2026

Unified helpdesk channels

General bureauinfo@anpay.in
Support operationssupport@anpay.in
Settlement & reversalsdispute@anpay.in
B2B partnershipsbusiness@anpay.in
Voice hotline011 6929 0388
WhatsApp corridor+91 94341 16115
Service window11:00 AM to 11:00 PM IST, every day
Tell us your name
Enter the 10-digit number on your account
Enter an email we can reply to
Pick the one that fits best
0 / 1000
A few lines, please — enough for us to act on

Do not test against live customer accounts. Never send your OTP, MPIN, card CVV, full card number or UPI PIN.

Questions about your data?

The compliance desk answers data rights inquiries and privacy complaints directly. Call, message, or use the form above.

Call 011 6929 0388 Read the AML framework

Corporate Information Security Policy · ISO/IEC 27001 aligned · effective 6 July 2026