Security conditions & cybersecurity disclaimer.

01Purpose and scope

These Security Conditions describe the security-related responsibilities, limitations, risks and expectations connected with NAND’s website and its web development services. They apply in three different contexts:

• A. NAND’s own website: the website you are reading. It has no user accounts, does not take payments and stores one item in your browser, as described in the Cookie Policy.
• B. Client websites and applications: websites and applications NAND develops for clients. Security work on these is set by the project’s agreed scope and the agreement for that project.
• C. Third-party services: hosting providers, domain registrars, APIs, open-source dependencies and other infrastructure connected to a project, which are operated by others.

Which provisions apply, and how, depends on the context, the project’s architecture, the agreed scope, any written agreement and applicable law. Not every provision applies in the same way to every project. Where a written agreement for a specific project deals with a matter differently, that agreement applies to that project.

These conditions should be read together with the Privacy Policy and the Terms and Conditions.

02Security measures and project scope

For client projects, NAND may put in place security measures suited to the project’s architecture, requirements, budget, agreed scope and technical constraints. Depending on the project, these may include:

• HTTPS and secure transport configuration;
• appropriate security headers;
• input validation and safe data handling;
• monitoring of dependencies for known vulnerabilities;
• bot protection and rate limiting;
• access controls and authentication protections;
• secure management of application secrets;
• appropriate hosting and deployment configuration;
• security testing and remediation within the agreed scope;
• reasonable configuration of third-party security services.

These are examples of measures that may be appropriate. They are not a statement that every measure is in place on every project, or on this website. The measures included in a project are those set out in its agreed scope.

Using a security tool or service does not, by itself, make a website secure. Its effect depends on how it is configured, maintained and used.

03No absolute security guarantee

No website, application, network, hosting environment or connected service can be guaranteed to be completely immune from cyberattacks, vulnerabilities, outages or data loss. Security measures reduce and manage certain risks; they cannot eliminate every possible threat. Risks that remain include:

• previously unknown vulnerabilities;
• newly discovered vulnerabilities in dependencies;
• credential theft or compromised accounts;
• social engineering and phishing;
• malicious activity by third parties;
• failures of infrastructure or service providers;
• unexpected software defects;
• attacks that bypass the controls in place;
• data loss or service interruption.

NAND does not describe any website, its own or a client’s, as “100% secure” or “unhackable”, and does not guarantee that every attack will be prevented.

A security incident does not, by itself, establish that NAND is responsible for the incident or its consequences. Responsibility will be assessed according to the circumstances, the applicable agreement, the parties’ respective obligations, and applicable law.

04Cyberattacks and external threats

Websites and applications connected to the internet may be exposed to malicious activity, including:

• distributed denial-of-service (DDoS) attacks;
• automated abuse and bot traffic;
• credential attacks;
• exploitation of software vulnerabilities;
• attempts to gain unauthorised access;
• malicious requests or payloads;
• abuse of exposed APIs;
• attacks targeting third-party infrastructure;
• other evolving cybersecurity threats.

The existence of these threats does not by itself establish that NAND caused, or is responsible for, a particular incident. Equally, an attack does not automatically release NAND from responsibilities it has under an agreement or applicable law. Responsibility depends on the actual facts, the obligations agreed, the applicable contract terms and applicable law.

05Third-party services and infrastructure

Websites commonly rely on services operated by other organisations, such as:

• hosting and deployment providers;
• DNS services and domain registrars;
• content delivery networks;
• cloud infrastructure;
• external APIs;
• payment providers;
• email delivery providers;
• authentication providers;
• open-source libraries and dependencies;
• external analytics and integration services.

These providers operate under their own terms, policies, technical controls and service arrangements. An outage, compromise, vulnerability, change or interruption of a third-party service can affect a website even when the website’s own code has not changed. NAND does not control these services and cannot guarantee their uninterrupted availability, security or future behaviour.

This section describes risks outside NAND’s control. It does not limit NAND’s responsibility for its own work: where NAND has expressly agreed to set up, configure or maintain a third-party integration, it remains responsible for doing that work as agreed. It does not exclude liability for NAND’s own conduct, for breach of an agreement, or any other liability that cannot lawfully be excluded.

06Client security responsibilities

For client projects, and as set out in the relevant agreement, clients may be responsible for:

• keeping their account credentials confidential;
• using strong, unique passwords;
• enabling multi-factor authentication where it is available;
• restricting access to authorised people;
• promptly removing access for former employees or contractors;
• renewing domains, hosting subscriptions and other services, where those responsibilities belong to the client;
• keeping client-controlled systems and credentials secure;
• telling NAND about suspected incidents;
• providing accurate technical information needed for remediation;
• maintaining backups, where backup responsibility has been assigned to the client;
• reviewing and approving changes that need the client’s authorisation.

How security responsibilities are shared is set by the agreement for each project. Clients are not responsible for every aspect of security, and using a third-party provider does not, on its own, make a client responsible for an incident.

07Security incident reporting and response

If you suspect a security incident affecting a website NAND built or maintains, contact NAND at nandui.web@gmail.com or on +91 9025009170. Where applicable, NAND’s general approach is to:

1. receive the incident report;
2. assess the information available;
3. determine whether the incident concerns NAND’s work, a client-controlled system or a third-party service;
4. take reasonable containment steps within the agreed scope and the access available;
5. communicate relevant findings to the affected client;
6. coordinate investigation and remediation;
7. recommend additional security measures where appropriate;
8. document the incident and the actions taken, where practical.

NAND does not commit to a fixed response time unless one has been agreed in writing for a project, and cannot guarantee complete recovery, no data loss or successful remediation in every case.

Emergency work, specialist investigation, forensic analysis, third-party charges and other work outside the agreed scope may need a separate written agreement or quotation, as described for additional work in the Terms and Conditions.

None of this delays any action or notification that applicable law or an existing agreement requires.

08Security maintenance, updates and support

• A. Support included with a project: completed website projects include a two-month post-completion support period, limited to its defined scope: correction of functional defects and code bugs in the agreed deliverables, as described in the Terms and Conditions. It is not unlimited development, permanent security monitoring or a guarantee against attacks.
• B. Optional maintenance: the optional 12-month maintenance subscription covers regular bug fixes, minor content updates, technical assistance and coordination of domain and hosting renewals, under its own agreed scope and commercial terms. Security monitoring is not part of it unless it is expressly agreed in writing.
• C. Work outside the agreed scope: new security features, infrastructure changes, major upgrades, specialist audits and other work outside the agreed scope are additional work. NAND assesses the requirement, explains the proposed work and its charge in writing, and begins only after the client approves it in writing.

No round-the-clock monitoring or fixed update and patching schedule is included unless it is agreed in writing for a specific project.

09Liability and limitations

A security incident does not, by itself, establish that NAND is responsible for the incident or its consequences. Responsibility will be assessed according to the circumstances, the applicable agreement, the parties’ respective obligations, and applicable law.

• NAND does not guarantee that every attack will be prevented, every vulnerability discovered, every service kept online or every item of data recovered.
• Subject to applicable law and the relevant agreement, the limitations of liability in the Terms and Conditions (section 13) and in any signed agreement for a project may apply to qualifying claims and losses. This page does not add any further limit, cap or amount.
• NAND does not claim that it can never be liable for a security incident. Nothing on this page excludes or limits liability for fraud, wilful misconduct, negligence, breach of contract or any other liability, where applicable law does not allow that liability to be excluded or limited.
• Nothing on this page affects rights that cannot be waived or limited under applicable law, including consumer protection law.

10Reporting security vulnerabilities

If you believe you have found a security vulnerability in the NAND website, or in a website NAND built, please report it by email to nandui.web@gmail.com with a subject line such as “Security report”.

Please include enough detail for NAND to understand and reproduce the issue, such as the affected page, the steps you took and what you observed, and leave out personal information that is not needed.

While looking into a possible issue, please do not:

• access other people’s accounts or private data;
• copy, extract or publish confidential information;
• disrupt the website or any service;
• carry out destructive tests;
• continue testing after you come across sensitive information;
• publicly disclose a vulnerability before NAND has had a reasonable opportunity to assess and respond to it.

NAND appreciates responsible reports and reviews them. This is not a bug bounty programme: no rewards are offered, and making a report does not authorise testing or give immunity from legal action.

11Personal information and privacy

Personal information NAND receives is handled as described in the Privacy Policy, and browser storage on this website as described in the Cookie Policy. These Security Conditions do not change those policies.

The measures listed in section 02 are examples of what may be appropriate for client projects. They do not describe how NAND stores or protects the information you send it. If this page and the Privacy Policy appear to differ about how information is collected, stored, processed or kept, the Privacy Policy applies.

12Changes to these Security Conditions

NAND may update these Security Conditions as its services, security practices and legal requirements change. Updates are published on this page, and the “Last updated” date above changes with each revision.

An update does not change an existing signed agreement, or apply retroactively, unless that agreement or applicable law allows it. Where an agreement requires the client’s consent to a material change, that requirement applies.