Security & Confidentiality Policy

QYROLAX TECHNOLOGIES PVT LTD — SECURITY & CONFIDENTIALITY POLICY Last updated: September 18, 2026 1. OVERVIEW Qyrolax Technologies Pvt Ltd ("Qyrolax," "we," "us," or "our") handles application details, test data, and candidate information as part of delivering software QA and testing services. This policy describes the technical and organizational measures we use to keep that information secure and confidential, and the commitments we make to clients and candidates. As stated on qyrolax.com, client engagements are treated as 100% confidential, with an NDA available on request. This document explains what sits behind that commitment. 2. CONFIDENTIALITY AND NDAs Every engagement is treated as confidential by default. We do not disclose a client's application, product plans, test results, defect reports, or business information to any third party without consent, except to the infrastructure providers needed to deliver the service (Section 9) or as required by law. We are glad to sign a mutual Non-Disclosure Agreement (NDA) before any discovery call, assessment, or engagement begins, at the client's request. Team members who work on a client engagement are bound by confidentiality obligations toward that client's data (Section 6). 3. ACCESS CONTROL Our CRM (panel.qyrolax.com), which holds client enquiries, candidate applications, and engagement data, is accessible only to authenticated Qyrolax staff: - Login requires a valid staff account and a CAPTCHA challenge, to block automated login attempts. - Access is protected by session-based authentication — a signed session cookie issued only after a successful login, checked on every CRM request. - The CRM subdomain is served only at panel.qyrolax.com and is not reachable through the public marketing site. - Password resets follow a verified, single-use link flow rather than sending or storing plaintext passwords. As Qyrolax grows beyond a single founder, access will be scoped by role (e.g., sales, delivery, HR) so staff only see the data relevant to their work. 4. DATA ENCRYPTION AND INFRASTRUCTURE In transit: the connection between our application and our production database (a managed MySQL instance hosted by Aiven) is encrypted using TLS. qyrolax.com and panel.qyrolax.com are served over HTTPS via our hosting provider, Vercel. At rest: data is stored on our managed database provider's infrastructure; we do not run our own on-premises servers. Application secrets: database credentials, API secrets, and similar configuration are kept out of our source code and set as environment variables in our hosting provider's dashboard, not committed to our codebase. Source code: our application source code is kept in a private GitHub repository with no external collaborators. 5. HOW CLIENT AND CANDIDATE DATA IS HANDLED Client engagement data. Application URLs, staging links, test objectives, and any credentials a client shares to enable testing are used solely to deliver the agreed QA/testing work, and only by the team members assigned to that engagement. We do not use a client's application or data for any purpose outside the engagement. Test artifacts. Test cases, defect reports, and coverage data generated during an engagement are treated as confidential and shared only with the client and the assigned Qyrolax team. Candidate data. Resumes and application details submitted through our Careers page are used only to evaluate the candidate for the role(s) they applied to, and are visible only to staff involved in hiring. 6. STAFF CONFIDENTIALITY OBLIGATIONS Anyone who works on Qyrolax client engagements — employee, contractor, or intern — is required to keep client and candidate data confidential, both during and after their time with Qyrolax, and to use it only for the purpose it was shared. As the team grows, this will be formalized through signed confidentiality agreements as part of onboarding. 7. INCIDENT RESPONSE If we become aware of a security incident affecting client or candidate personal data, we will: 1. Contain the incident and assess what data was affected 2. Notify affected clients without undue delay, along with what we know and what we're doing about it 3. Notify the relevant authorities where required under the DPDP Act or other applicable law 4. Take corrective action to prevent recurrence 8. DATA RETENTION AND DELETION We keep client engagement data, test artifacts, and candidate data only for as long as needed to deliver the engagement or evaluate the application, plus a limited period afterward for legal, accounting, or reference purposes. On request, we will delete or return a client's data at the end of an engagement, subject to any legal retention requirements. Candidates may request deletion of their application data at any time (see our Privacy Policy). 9. INFRASTRUCTURE SUB-PROCESSORS - Aiven — managed MySQL database hosting, TLS-encrypted connections - Vercel — application hosting and deployment - Google Workspace — business email - GitHub — private source code repository We select providers that offer encryption in transit and access controls appropriate to the data we handle, and we review this list as our infrastructure evolves. 10. CONTACT For security or confidentiality questions, or to request an NDA before an engagement begins, contact: Gaurav Tripathi Qyrolax Technologies Pvt Ltd Email: gaurav@qyrolax.com General enquiries can also go to info@qyrolax.com.