Security Policy

1. Our commitment

Layer Co. takes the security of customer data, payment information, and website infrastructure seriously. This policy outlines the safeguards we have in place and the procedures we follow.

2. Data transmission

All data transmitted between your browser and our website is encrypted using HTTPS (TLS 1.3). Forms, contact requests, and any customer-submitted information travel over a secure connection. Our SSL certificate is provisioned and auto-renewed by Netlify.

3. Hosting infrastructure

Our website is hosted on Netlify, a trusted edge-network provider with ISO 27001-certified data centres, automatic DDoS mitigation, and continuous security monitoring. Form submissions are stored on Netlify's secure form-handling infrastructure.

4. Payment security

We do not store credit/debit card information on our servers. All card payments are processed via PCI-DSS compliant payment gateways (e.g., Razorpay, Stripe). Bank transfers and UPI payments occur directly through your banking provider — we never see your account credentials.

5. Internal access controls

• Customer data is accessible only to authorised Layer Co. team members on a need-to-know basis.
• All admin accounts use multi-factor authentication.
• Cloud storage is restricted to encrypted, access-controlled buckets.
• Devices used by staff are protected by full-disk encryption.

6. Incident response

In the unlikely event of a data breach or security incident affecting customer information, we will:

• Investigate and contain the issue within 72 hours.
• Notify affected customers via email with details of what occurred and what data was impacted.
• Report the incident to relevant Indian authorities as required under the Digital Personal Data Protection Act, 2023.

7. Responsible disclosure

If you believe you have discovered a security vulnerability in our website or systems, please report it to sunny@layercompany.in with the subject line "Security Disclosure". We commit to:

• Acknowledge your report within 48 hours.
• Investigate and remediate verified issues promptly.
• Credit researchers (with permission) for responsible disclosures.

Please do not publicly disclose vulnerabilities until we have had a reasonable opportunity to address them.

8. Third-party services

We use a limited number of vetted third-party services (Netlify for hosting, Google Fonts for typography, FormSubmit/Netlify Forms for contact form handling). Each is selected for its security posture and minimal data collection. See our Privacy Policy for more details.

9. Updates

We continuously review and improve our security practices. This policy will be updated as our infrastructure and practices evolve.

10. Contact

Security questions? Email sunny@layercompany.in.