Security & Compliance

eeaso ("Platform", "Service", "Application", or "Software") is operated by ELANTRA TECHNOLOGIES PRIVATE LIMITED ("Company", "Elantra", "we", "our", or "us").

The Company is committed to protecting the confidentiality, integrity, availability, and security of information processed through the Platform.

This Security & Compliance Statement describes the Company’s security principles, operational safeguards, infrastructure controls, privacy commitments, and compliance practices.

This document is intended for customers, enterprise clients, agencies, business partners, procurement teams, auditors, and other stakeholders seeking information regarding eeaso’s security posture.

The Company’s security program is based upon the following principles:

• Confidentiality — protecting information against unauthorized access and disclosure.
• Integrity — protecting information against unauthorized modification, corruption, or destruction.
• Availability — maintaining reliable access to systems and services.
• Accountability — maintaining appropriate governance, oversight, monitoring, and auditability.
• Privacy — processing information in accordance with applicable legal and contractual obligations.

Security is a shared responsibility between the Company and Platform users.

Company responsibilities include:

• Platform infrastructure security;
• System administration;
• Platform monitoring;
• Access management controls;
• Service availability controls;
• Security response procedures;
• Security maintenance and updates.

Customer responsibilities include:

• Protecting login credentials;
• Managing workspace access;
• Reviewing permissions;
• Securing connected third-party accounts;
• Reviewing AI-generated outputs;
• Ensuring lawful use of the Platform;
• Managing organizational access policies.

The Company shall not be responsible for security failures resulting from customer actions, misconfigurations, credential sharing, or unauthorized user activity.

eeaso utilizes reputable cloud-based infrastructure providers and technology partners to support platform operations.

Infrastructure safeguards may include:

• Secure hosting environments;
• Network controls;
• Firewalls;
• Access restrictions;
• Infrastructure monitoring;
• Resource isolation;
• Security logging;
• Environment segregation where appropriate.

Infrastructure providers may implement additional safeguards according to their own security programs.

The Company maintains controls designed to restrict access to authorized individuals and systems.

Security measures may include:

• Secure authentication procedures;
• Password hashing using industry-standard cryptographic methods;
• Session management controls;
• Role-based permissions;
• Access restrictions;
• Administrative access controls;
• Credential management procedures.

Users remain responsible for maintaining the confidentiality of their credentials.

Where appropriate, information may be protected using encryption technologies.

Security measures may include:

• Encryption of authentication information;
• Encryption of sensitive credentials;
• Secure communication channels;
• Transport Layer Security (TLS);
• Infrastructure-level encryption controls provided by hosting providers.

No encryption technology can guarantee absolute security.

The Company follows commercially reasonable practices intended to improve application security.

Such practices may include:

• Software testing;
• Code reviews;
• Dependency management;
• Security monitoring;
• Vulnerability remediation;
• Logging and auditing;
• Change management procedures.

Security improvements may be implemented without prior notice where necessary to protect users and the Platform.

Where users connect Facebook, Instagram, WhatsApp Business, or other Meta-authorized services, eeaso may process information necessary to maintain authorized integrations.

Security measures may include:

• Token protection mechanisms;
• Access controls;
• Secure API communications;
• Authentication safeguards;
• Monitoring and logging.

eeaso does not sell Meta Platform Data. Users may revoke Meta permissions at any time through Meta account settings.

Certain features of eeaso may utilize artificial intelligence technologies supplied by authorized providers.

The Company may implement controls intended to restrict unauthorized access, protect operational information, monitor service integrity, and maintain platform functionality.

AI-generated outputs are intended solely as informational, productivity, workflow, or analytical assistance tools. Users remain responsible for reviewing and validating AI-generated outputs.

The Company shall retain information only for as long as reasonably necessary to provide the Services, comply with legal obligations, resolve disputes, maintain security, prevent fraud, and enforce contractual rights.

Unless otherwise required by law:

• Account information may be retained for up to three (3) years following account closure.
• Customer support information may be retained for up to three (3) years.
• Analytics and operational information may be retained for up to three (3) years.
• Security-related information may be retained for up to three (3) years.

Upon expiration of applicable retention periods, information may be deleted, anonymized, or aggregated.

The Company maintains procedures intended to detect security incidents, investigate suspicious activity, contain operational risks, mitigate security impacts, and support remediation efforts.

Where required by applicable law, notifications may be provided to affected parties and authorities.

Notification of a security incident shall not constitute an admission of fault or liability.

The Company takes commercially reasonable measures intended to support continuity of operations.

Such measures may include:

• Cloud-based infrastructure;
• Backup procedures;
• Monitoring systems;
• Recovery planning;
• Operational resilience measures.

The Company does not guarantee uninterrupted availability of the Platform.

The Company is committed to maintaining compliance with applicable legal and contractual obligations, including:

• The Digital Personal Data Protection Act, 2023;
• The Information Technology Act, 2000;
• Applicable contractual obligations imposed by authorized integration providers;
• Internal privacy and security practices.

Customers remain responsible for compliance obligations relating to their own use of the Platform.

Users and security researchers may report security concerns by contacting: elantra@elantratechnologies.co.in.

Reports should include:

• Description of the issue;
• Relevant technical details;
• Contact information;
• Steps to reproduce (where appropriate).

The Company reserves the right to investigate and respond to reports according to internal procedures.

The Company reserves the right to amend, update, replace, or modify this Security & Compliance Statement at any time.

Updated versions shall become effective upon publication on the Platform. Continued use of the Platform following publication constitutes acceptance of the revised version.

eeaso, operated by ELANTRA TECHNOLOGIES PRIVATE LIMITED (CIN: U62012KA2026PTC218933).

Registered Office: Girija Nivasa, Valmiki Nagar, Challakere, Chitradurga – 577522, Karnataka, India.

Email: elantra@elantratechnologies.co.in. Website: www.eeaso.com.