Our security approach
StartupPact handles identity records, business documents and statutory work that deserve careful treatment. We use managed infrastructure, encrypted web connections and operational controls designed to reduce unauthorised access, loss and misuse.
Security is a shared and evolving responsibility. This page describes current commitments without claiming certifications or controls that have not been independently verified.
Account and workspace access
Private workspace data is tied to authenticated accounts. Business records are separated through access rules, and users can access only information their account and business role permit.
We may verify identity or authority before changing ownership, releasing sensitive records or acting on unusual instructions.
Document handling
Uploaded documents are held in protected managed storage. Access is limited according to the service and role, including assigned staff or professionals who need the material to perform the engagement.
We avoid requesting documents that are not reasonably needed. Sharing outside the workspace is limited to service delivery, authorities, contracted providers or legal obligations.
Payment protection
Payments are completed through Razorpay’s hosted payment flow. StartupPact receives the amount, transaction reference and status needed to confirm an order, but does not store your complete card details, UPI PIN or banking password.
Always verify the domain and amount before authorising payment. StartupPact will not ask you to disclose an OTP, UPI PIN or card PIN by email, phone or chat.
Operational safeguards
Our safeguards include role-based access, restricted administrative functions, service logging, managed backups and separation between public pages and authenticated workspaces. Providers maintain additional infrastructure controls under their own programmes.
We do not publish unsupported claims of SOC 2 or ISO certification, round-the-clock monitoring, penetration testing, multi-factor authentication or India-only data residency.
What account holders should do
- Use a unique password and protect access to your email and devices.
- Do not share sign-in links, OTPs or payment credentials.
- Review invited users and remove access that is no longer required.
- Check downloaded documents before forwarding them outside your organisation.
- Report unexpected account, document or payment activity promptly.
Incident response
We investigate suspected security events, contain access where practical, preserve relevant records and work with affected providers or authorities when required. If an incident creates a notification obligation, we will communicate in accordance with applicable law using the contact information available to us.
Backups, retention and availability
Managed backups support recovery, but no online service can guarantee uninterrupted availability or recovery of every locally deleted or externally changed record. Retention follows service, legal and professional needs described in the Privacy policy.
Report a security concern
Email the company address below with a clear description, affected page or account, approximate time and safe steps to reproduce. Do not access another person’s data, disrupt the service, publish personal information or demand payment.
We will acknowledge good-faith reports and prioritise issues based on likely impact. For urgent account access concerns, also change your password and secure the associated email account.
