Security & Data

1. Our Security Commitment

FODUU Studio (operated by Foundation of Design Uprising Unit, Indore, Madhya Pradesh) builds, hosts and maintains websites, e-commerce stores, dashboards and POS integrations for Indian businesses. Security is not an add-on: every layer of the platform, from the website builder to the WhatsApp bot, is designed with a defence-in-depth approach.

2. Infrastructure & Hosting

All FODUU Studio sites and databases run on hardened cloud infrastructure located in India (Mumbai & Hyderabad regions) inside Tier-IV certified data centers.

• Isolated environments: Each customer store runs in its own logically isolated workspace. No tenant can read another tenant's files or database.
• Global CDN with Indian edge nodes: Static assets and images are served from edge locations for fast load times, with origin servers kept private.
• Web Application Firewall (WAF): Every request is filtered for SQL injection, cross-site scripting, bot abuse and known exploit signatures.
• DDoS protection: Always-on volumetric and application-layer mitigation keeps your storefront online during traffic spikes and attacks.
• Patched & hardened servers: Operating systems and runtimes receive security updates on a rolling schedule; critical patches are applied within 24 hours.

3. Encryption

Data is protected both while it travels and while it sits in storage:

• In transit: Every site on FODUU Studio ships with a free, auto-renewing SSL certificate. Connections are enforced over HTTPS with TLS 1.2+ (TLS 1.3 preferred) and HSTS enabled.
• At rest: Databases, file storage, backups and logs are encrypted with AES-256. Encryption keys are managed separately from the data they protect and rotated periodically.
• Credentials: Account passwords are never stored in plain text. They are hashed using a modern, salted, slow hashing algorithm (bcrypt/Argon2).
• API & integration keys: Payment gateway, logistics and WhatsApp API tokens are stored in an encrypted secrets vault, never in site code or exports.

4. Backups & Recovery

Mistakes and outages happen. Our backup strategy makes sure they are never permanent:

• Automated differential backups every 6 hours of your database, media library and site configuration.
• Daily full snapshots retained for 30 days, with weekly snapshots kept for 90 days.
• Geo-redundant storage: Backups are replicated to a second Indian region so a single data-center failure cannot cause data loss.
• One-click restore: Restore your site or catalog to any available restore point from the FODUU dashboard, or ask support to do it for you.
• Tested regularly: Restore drills are run every quarter to verify backups are complete and recoverable.

5. Access Control

Only the right people should be able to touch your data, on your side and ours:

• Role-based permissions: Invite staff as Owner, Manager, Cashier or Content Editor with clearly scoped access to orders, inventory, payouts and site settings.
• Two-factor authentication (2FA): Available for every account via OTP on mobile or authenticator app, and enforced for Owner accounts handling payouts.
• Session security: Sessions expire after inactivity, and you can view and revoke active devices from your account settings.
• Audit logs: Logins, permission changes, price edits, refunds and data exports are recorded with timestamp, user and IP address.
• FODUU staff access: Our engineers access customer data only for support or incident resolution, under least-privilege rules, with every access logged and reviewed.

6. Payment & POS Security

FODUU Studio never stores your customers' full card numbers, CVVs or UPI PINs.

• PCI-DSS compliant gateways: All payments are processed by certified partners such as Razorpay, Cashfree, PhonePe and Paytm. Card data goes directly to the gateway and never touches FODUU servers.
• Signed webhooks: Payment confirmations are verified with cryptographic signatures so orders can only be marked paid by the gateway itself.
• POS sync integrity: Stock deductions between online orders and physical POS terminals are transmitted over encrypted channels with conflict detection to prevent double-selling or tampered counts.
• WhatsApp & messaging: Transactional messages go through the official Meta WhatsApp Cloud API. Customer numbers are used only for order-related pings your store triggers.
• Fraud signals: Suspicious order patterns, repeated failed payments and risky geolocations are flagged in your dashboard for review before fulfilment.

7. Monitoring & Incident Response

Our platform is watched around the clock:

• 24×7 monitoring of uptime, error rates, unusual traffic and authentication anomalies, with automated alerting to the on-call engineering team.
• Vulnerability management: Dependencies and container images are scanned continuously; third-party penetration testing is performed at least annually.
• Incident response plan: Confirmed security incidents are contained, investigated and remediated following a documented playbook.
• Breach notification: If an incident affects your data, we will notify you without undue delay, and within 72 hours at the latest, with details of what happened and what we are doing about it, in line with the Digital Personal Data Protection Act, 2023 and CERT-In directions.

8. Data Ownership & Retention

You retain 100% ownership of your website content, product catalog, customer database, order history and analytics.

• Export anytime: Download your complete store data as ZIP and CSV formats with a single click from the FODUU dashboard, during or after your subscription.
• No lock-in: Exported product, customer and order files use open, standard formats you can import into other platforms.
• Retention after cancellation: Your data is kept for 90 days after a subscription ends so you can reactivate or export it, then permanently deleted from live systems and purged from backups on the next rotation cycle.
• Deletion on request: Email us and we will delete your account data within 30 days, except records we are legally required to keep (such as GST invoices).
• No selling of data: Customer lists, order telemetry and transaction data are never sold to third parties or advertising networks.

For details on what information we collect and why, see our Privacy Policy.

9. Your Responsibilities

Security is a shared effort. To keep your store safe, we recommend that you:

• Use a strong, unique password and turn on two-factor authentication for all Owner and Manager accounts.
• Give staff only the roles they need, and remove access promptly when someone leaves.
• Never share login OTPs, API keys or payout details over chat, email or phone.
• Keep your registered email and mobile number up to date so you receive security alerts.
• Review audit logs and payout settings periodically for anything unexpected.

10. Report a Vulnerability

If you are a security researcher or customer and believe you have found a vulnerability in FODUU Studio, please tell us before disclosing it publicly. We will acknowledge your report within 2 business days and keep you updated as we fix it. We do not take legal action against good-faith research conducted without harming customer data or service availability.

FODUU Studio Security Team
Email: security @foduu .com
Privacy & data requests: privacy @foduu .com
Office: Vijay Nagar, Indore, Madhya Pradesh 452010, India