Security & Responsible Disclosure

TempleOS protects temple and devotee information through layered technical and organisational safeguards. This page also provides a safe channel for good-faith vulnerability reports.

1. Security practices

• HTTPS/TLS for data in transit and restricted database connectivity.
• Tenant separation, role-based permissions and auditable administrative access.
• Protected secrets, security logging, monitoring and rate limiting.
• Automated backups, off-site copies and tested recovery procedures.
• Dependency maintenance, vulnerability review and controlled production deployment.

2. Customer responsibilities

Customers must protect administrator accounts, terminal tokens, local servers, printers and networks; remove access when staff leave; use supported software; and report suspected compromise promptly.

3. Reporting a vulnerability

Email support@templeos.in with the subject Confidential security report. Include the affected URL or component, reproduction steps, impact and a safe contact method. Do not include real devotee data unless specifically requested through a secure channel.

4. Safe research expectations

Use test accounts and the minimum access necessary. Do not disrupt service, access another tenant, download personal data, alter financial records, use social engineering, publish an unresolved issue or demand payment as a condition of disclosure. Stop testing when sensitive data is encountered and report it immediately.

5. Our response

TempleOS will acknowledge a credible report, assess severity, communicate reasonable progress and remediate according to risk. Public recognition may be provided with the reporter's consent after remediation. This process does not create a promise of payment.

6. Service incidents

Operational incidents should be reported to the same address or by calling +91 89043 88568. Personal-data incidents are handled under the Privacy Policy and applicable notification duties.