How We Keep Your Data Safe

Version 2026-10-28-draft

Draft for professional review

This document is a working draft and has not yet been reviewed by legal counsel. Bracketed items are pending company details.

What we have built to keep each business's data separate and protected. We describe controls plainly and do not claim certifications we do not hold. No system can be guaranteed completely secure.

1. Your own private space

Every business gets its own separate, secure database, created when its registration is approved. Your buyers, staff, projects, flats, deals and their history are kept there and nowhere else.

Each business's space is locked with its own key, stored encrypted. That key opens only your data and nothing else.

2. Only you reach your data

When you sign in, we find your workspace from your account and check that it is active before anything is opened. Changing a web address or a link can never take you into another business's data.

Every time your data is opened, we check it really is your workspace.

3. Accounts and access

Passwords are stored in a form that cannot be turned back into the password. Accounts lock for 15 minutes after 5 wrong passwords. Activation, invitation and reset links work once and expire. Suspending or removing a person signs them out at once.

Roles and permissions are checked every time something is opened or changed, not just hidden on the screen. Sales executives see only their own buyers; managers see their team's.

4. H&G NextGen staff

Our staff who handle registrations see registrations, payments and account status, and have no way to browse your leads, staff, projects or deals. Payment evidence is visible only to people authorised to review payments, and every view is logged.

H&G NextGen administrators can view and export workspace data when needed to support, secure or bill the service, or when the law requires it. Every view, download and change they make is recorded in a tamper-proof audit log.

5. Audit trails

Sensitive actions are logged with who, what and when. Audit records, buyer history and invoices can never be edited or deleted.

6. Payments and files

Every payment is confirmed with Razorpay. Payment screenshots are checked, stored privately and never given a public link.

7. Backups

Your data is backed up regularly [frequency and retention to be confirmed before launch]. Each business can be restored on its own.

8. Reporting a problem

Report suspected security issues to support@handgnextgenpvtltd.com with the subject "Security".