1. Security Architecture & Principles

At Axivon Technologies, security is engineered into every layer of our stack: - **Encryption Everywhere:** All traffic is encrypted in transit using TLS 1.3 with strict HSTS headers. Sensitive database columns and stored documents are encrypted at rest using AES-256. - **Robust Access Controls:** Enterprise Role-Based Access Control (RBAC) enforces strict boundaries between Founder, Admin, Employee, Client, Broker, and Partner roles. - **Bot & Spam Mitigation:** Server-verified Cloudflare Turnstile anti-bot checks protect all public forms and authentication endpoints. - **Credential Safety:** Passwords are hashed using salted cryptographic algorithms; plaintext passwords are never logged or stored.

2. Responsible Vulnerability Disclosure Program

We welcome reports from ethical security researchers to help us keep our platform safe. If you believe you have discovered a security vulnerability in Axivon systems: 1. Email your findings to **security@axivontech.in** (cc: **support@axivontech.in**). 2. Provide sufficient detail, including steps to reproduce, affected endpoints, and proof-of-concept payloads. 3. Allow us a reasonable timeframe (typically 30 business days) to investigate and remediate before public disclosure.

3. Safe Harbor Commitment

If you conduct vulnerability research in good faith and in compliance with this policy: - We will not pursue legal action or report your activities to law enforcement. - We will collaborate with you to understand and address the issue promptly. - We will publicly acknowledge your contribution in our Security Hall of Fame (unless you request anonymity).