Enterprise-Grade Security Architecture

Security & Data Governance

Covered Domains: sedigital.in & partnercliq.com | Version 2.4 | Review Cadence: Semi-Annual

SEDigital Technologies India Private Limited operates zero-trust security controls engineered to protect commercial ad spend, customer conversion telemetry, and partner integrations.

Cryptographic Standards

TLS 1.3 encryption across all network transfers with forward secrecy. Persistent databases protected by AES-256 encryption at rest.

Zero-Trust Identity & MFA

Mandatory hardware/app-based Multi-Factor Authentication (MFA) for every senior operator. Role-based access control (RBAC) enforced across all platform consoles.

SOC 2 Certified Cloud

Hosted on AWS Asia Pacific (Mumbai) and Google Cloud Platform with ISO/IEC 27001, SOC 2 Type II, and PCI-DSS Level 1 compliance.

SHA-256 Hashing Protocol

All client attribution signals and customer parameters are normalized and cryptographically hashed locally before dispatch to ad platform CAPI endpoints.

1. Scoped Account Access & Least Privilege

We enforce the principle of least privilege (PoLP) across all client engagements:

No Password Sharing: Account managers never request, store, or accept raw master passwords for Meta Business Managers, Google Ads, or Shopify;
Partner Access Delegation: Access is established solely through official partner authorization workflows (Meta Business Partner agency access, Google Ads Manager link requests, Shopify Collaborator Accounts with limited code);
Immediate Revocation: Access tokens and partner associations are automatically audited and severed within 24 hours of engagement completion.

2. Server-Side Hashing & Attribution Security

When connecting Meta Conversions API (CAPI) or Google Offline Conversions:

Client-Side SHA-256 Normalization

All sensitive customer parameters (email, telephone number, postal codes) are trimmed, lowercased, and converted into one-way 256-bit cryptographic hashes directly on the client hosting server before reaching transit. Plaintext personal data never resides on SEDigital servers.

3. Incident Response & Statutory Breach Notification (CERT-In SLA)

SEDigital maintains a documented Incident Response Plan (IRP) aligned with the directives issued by the Indian Computer Emergency Response Team (CERT-In) under Section 70B of the Information Technology Act, 2000.

Detection & Containment: Real-time automated alerts for abnormal API usage, unauthorized access attempts, or perimeter anomalies.

Mandatory Reporting: Cyber security incidents of specified categories are reported to CERT-In within 6 hours of notice, and affected partners within 24 hours.

4. Operational Security & Endpoint Protection

All operator workstations are centrally managed with full-disk encryption (FileVault / BitLocker) and automatic OS patching;
Zero public Wi-Fi usage without commercial enterprise VPN encryption;
Comprehensive background verification and confidentiality agreements signed by all media buyers and data specialists prior to account onboarding.

5. Responsible Vulnerability Disclosure Program

We welcome responsible security research. If you discover a potential vulnerability in our web applications, APIs, or infrastructure:

Direct Security Operations Channel:

security@sedigital.in

Please include technical reproduction steps, request logs, and proof-of-concept material. We commit to acknowledging reports within 24 business hours and will not initiate legal action against researchers acting in good faith under responsible disclosure principles.