Security Policy

This Security Policy outlines the technical, administrative, and physical controls established by Era Biz Solutions (Pvt) Ltd to protect Customer Data, Personnel Data, and system infrastructure within the AccDoo.ai multi-tenant cloud environment. This policy applies to all systems, employees, networks, and third-party sub-processors contributing to the delivery of AccDoo Services worldwide.

Our security infrastructure is architected to simultaneously satisfy global privacy frameworks:

• Sri Lanka PDPA (No. 9 of 2022): Satisfies Section 23 obligations by protecting integrity and confidentiality against unauthorized processing, loss, or damage.
• EU & UK GDPR (Article 32): Ensures the ongoing confidentiality, integrity, availability, and resilience of systems, utilizing automated data pseudonymization and localized access protocols.
• US State Laws (CCPA/CPRA):Maintains “reasonable security procedures and practices” to prevent statutory private right-of-action triggers due to data breaches.

• Primary Hosting: All production data, core ledger microservices, and databases are hosted on Amazon Web Services (AWS) in the US East (Virginia, USA) region.
• Physical Security: Data centers maintain 24/7/365 physical security, biometric access entry checkpoints, surveillance logs, and independent certifications (ISO 27001, SOC 2 Type II).
• Network Isolation: Customer production environments are strictly separated from non-production development environments. Virtual Private Clouds (VPCs) and security groups isolate system tiers.

• Data in Transit: All connections to accdoo.ai and associated APIs are forced over HTTPS using Transport Layer Security (TLS 1.3) with robust cipher suites. Legacy, unencrypted protocols are entirely blocked.
• Data at Rest: Customer business ledgers, hashed login credentials, and HRMS records are encrypted using AES-256 bit encryption at the storage volume layer.
• Key Management: Encryption keys are managed securely via AWS Key Management Service (KMS) with automatic, scheduled cryptographic key rotation.

• Staff Access Restrictions: Era Biz Solutions personnel are granted infrastructure access strictly on the Principle of Least Privilegeand a “Need-to-Know” operational basis.
• Authentication Requirements: All employee administrative connections require mandatory Multi-Factor Authentication (MFA), strict password complexity profiles, and hardware-bound tokens.
• Audit Logging: Every single database query, administrative configuration change, and server access event is recorded in a centralized, read-only audit log monitored for structural anomalies.

• Continuous Monitoring: Automated network scanners inspect our software components continuously for known CVE dependencies and configuration flaws.
• Penetration Testing: Independent, certified cybersecurity firms conduct deep web application penetration tests at least once every twelve (12) months.
• AI Feature Guardrails: Data processed via our AI Feature integrations (API wrappers with OpenAI) uses strictly encrypted, non-caching data pipelines. Prompts are zero-retention and contractually barred from training general public models.

• Data Redundancy: Database clusters utilize active real-time replication across isolated Availability Zones inside our primary AWS data center.
• Backup Schedule: Automated incremental system backups are generated daily. Full snapshots are compiled weekly.
• Backup Security & Lifecycle: All backup volumes are thoroughly encrypted, stored independently from live workspaces, and systematically overwritten on a strict 35-day rotation loop.