Security

Security is a product requirement — not an afterthought. Our controls map to ISO 27001:2022, SOC 2 (Security, Availability, Confidentiality), and the OWASP ASVS, with additional overlays where a product demands it (e.g., HIPAA safeguards for MetaHealth, PCI DSS for MetaCard/MetaLedger flows).

We operate on the principle of least privilege, defence in depth, and continuous verification: every layer is independently hardened and monitored.

• In transit: TLS 1.2+ with HSTS and certificate transparency; internal service-to-service mTLS where applicable.
• At rest: AES-256 encryption for databases, object storage, and backups; per-environment keys in a managed KMS with rotation and separation of duties.
• Network: VPC isolation, private subnets, WAF, DDoS mitigation, and egress filtering. No direct public access to data stores.
• Secrets: Centralised secrets manager; no secrets in code or images. Short-lived, scoped tokens.

• Customer auth: Email + strong password (argon2/bcrypt hashing), optional MFA, session hardening (httpOnly, Secure, SameSite, short-lived access tokens + refresh rotation).
• Workforce: SSO + MFA enforced, RBAC/ABAC with quarterly access reviews, just-in-time privilege elevation, and immediate de-provisioning on role change.
• Logging: Centralised, tamper-evident audit logs for auth, admin, and data-access events (retained per Compliance schedule).

• Threat modelling for high-risk features and every new product integration.
• SAST, dependency scanning, container scanning, and secret scanning in CI — builds fail on high-severity findings.
• DAST and authenticated penetration testing before major releases and at least annually by an independent firm.
• Signed builds, reproducible pipelines, and environment promotion via code (no manual prod changes).
• Third-party libraries vetted for maintenance, licence, and vulnerability posture.

• Monitoring: Centralised SIEM, anomaly detection, and uptime/integrity probes across products.
• Response: Documented incident response plan with defined severity levels, on-call rotation, and customer notification paths. For personal-data incidents we notify the DPO and affected customers without undue delay and, where required, the Data Protection Board of India.
• Lessons: Every S1/S2 incident yields a post-mortem, tracked remediations, and a control improvement.

We patch by risk: critical production fixes within 24–72 hours, high within 14 days, with compensating controls if a direct patch is not yet available. Customers are notified of material, customer-actionable vulnerabilities via security advisories.

• Isolation: Logical tenant isolation with row-level checks and automated isolation tests.
• Minimisation: Products collect only the fields required for the stated purpose.
• Residency: Primary data residency in India; any cross-border processing uses approved transfer mechanisms per our Privacy Policy.
• Retention & deletion: Per product DPA — with soft-delete, purge, and crypto-shredding where applicable.

• Daily encrypted backups with point-in-time recovery and quarterly restore drills.
• Multi-AZ deployment for critical services; defined RPO/RTO per product and published in SLAs.
• Business continuity and disaster-recovery plans tested at least annually.

We appreciate responsible disclosure. Please do not access, modify, or exfiltrate data beyond what is necessary to demonstrate the issue.

• Email: tech@metadev.in (PGP available on request)
• Include: product/URL, steps to reproduce, impact, and your contact for follow-up.
• We acknowledge within 2 business days, provide a triage timeline, and keep you updated. We commit not to pursue legal action for good-faith research that follows these guidelines.
• For abuse or fraud involving a MetaDev product, write to support@metadev.in.

This page describes our approach at a high level. Customer contracts, DPAs, and product security addenda contain binding commitments.