Security & Data Protection Policy

1. Security Philosophy

Security is designed to support:

• Confidentiality
• Integrity
• Availability
• Accountability
• Least-privilege access
• Operational resilience

Security controls evolve as products, infrastructure, and threats evolve.

2. Security Governance

Security responsibilities are managed through:

• Internal ownership structures
• Role-based responsibilities
• Controlled administrative access
• Operational procedures
• Change management processes

Security ownership may involve:

• Product teams
• Engineering teams
• Operations teams
• Leadership teams

3. Access Management

Access controls may include:

• Role-based access controls (RBAC)
• Permission management
• User provisioning workflows
• Access approvals
• Workspace segregation
• Session controls
• Authentication requirements
• Administrative restrictions

Access rights may be reviewed periodically.

4. Authentication Controls

Authentication mechanisms may include:

• Password authentication
• Multi-factor authentication where supported
• Session management
• Access expiration controls
• Login monitoring
• Credential validation mechanisms

Customers remain responsible for protecting credentials.

5. Data Encryption

Security controls may include:

Encryption In Transit

Data transmission may use:

• TLS encryption
• HTTPS communication
• Secure APIs
• Encrypted communication channels

Encryption At Rest

Stored information may use:

• Database encryption
• Storage encryption
• Backup encryption
• Managed encryption mechanisms

6. Data Segregation

Systems may implement controls to separate:

• Customer environments
• User permissions
• Workspaces
• Tenant data
• Product-specific information

Logical separation methods may vary by architecture.

7. Infrastructure Security

Infrastructure controls may include:

• Environment isolation
• Firewall controls
• Network restrictions
• Infrastructure monitoring
• Logging systems
• Patch management
• Infrastructure backups

Infrastructure architecture may evolve over time.

8. Application Security

Application security practices may include:

• Access restrictions
• Input validation
• Audit logging
• Permission checks
• Session controls
• Dependency updates
• Change reviews

Security measures are continuously evaluated and improved.

9. Logging and Auditability

Operational systems may generate logs for:

• Authentication events
• User actions
• Permission changes
• Administrative actions
• API activity
• Error events
• Security monitoring

Retention periods: _[Insert log retention policy]_

10. Monitoring and Detection

Security monitoring may include:

• Infrastructure monitoring
• Error monitoring
• Availability monitoring
• Usage monitoring
• Suspicious activity monitoring

Monitoring does not guarantee detection of all threats.

11. Backup and Recovery

Backup procedures may include:

• Scheduled backups
• Recovery testing
• Redundancy controls
• Disaster recovery planning

Recovery targets:

• RPO: _[RPO placeholder]_
• RTO: _[RTO placeholder]_

12. Incident Management

Security incidents may be handled through:

• Detection
• Investigation
• Containment
• Remediation
• Recovery
• Post-incident review

Incident timelines vary depending on severity.

13. Vulnerability Management

Security activities may include:

• Software updates
• Dependency reviews
• Infrastructure updates
• Risk assessments
• Vulnerability remediation

Testing frequency: _[Insert testing frequency]_

14. Customer Responsibilities

Customers remain responsible for:

• User management
• Credential security
• Device security
• Correct permissions
• Data uploaded into systems
• Internal compliance obligations

Shared responsibility applies to platform security.

15. Product-Specific Security — NestLens

NestLens security controls may support:

• Workspace segregation
• Export controls
• Access restrictions
• Monitoring controls
• User permissions
• Dataset restrictions

Intelligence outputs remain subject to user permissions.

16. Product-Specific Security — NestHR

NestHR security controls may support:

• Employee access restrictions
• HR permission layers
• Approval workflows
• Workforce data access control
• Role-specific visibility

Organizations remain responsible for HR compliance obligations.

17. Third-Party Providers

Security controls may depend on third-party providers including:

• Hosting vendors
• Authentication providers
• Monitoring vendors
• Payment processors
• Analytics providers

Provider list: _[Insert vendors]_

18. Compliance Alignment

Security programs may align with:

• Applicable privacy laws
• Customer contractual requirements
• Security best practices

Formal certifications: _[Insert certifications if applicable]_

19. Policy Changes

This policy may change periodically.

Updates may be communicated through:

• Website notices
• Product notifications
• Email communication

20. Contact Information

Security and Operational Queries: ops@labelnest.in

Privacy Queries: privacy@labelnest.in

General Support: support@labelnest.in

Address:

No. 33, 4th Floor, 1st Main, CBI Main Rd, HMT Layout, Ganganagar, Bengaluru 560032