Security Policy

Scope

Trolly Ecommerce Pvt. Ltd. manages security for the WebMins platform, including accounts, projects, provider connections and digital fulfilment. Customer-created websites and their external deployments also need independent review. This statement describes verified application controls and the approved production environment; it is not a security certification.

Verified application controls

The application checks authenticated access tokens against active user records, supports refresh sessions and checks staff permissions server-side. Password authentication uses stored hashes. Project operations are associated with the authenticated owner. Saved AI API credentials use authenticated encryption and are not returned as plaintext in ordinary connection responses.

OAuth and sessions

ChatGPT identity linking uses PKCE, one-time state, nonce and browser binding, with signature, issuer and audience validation. Returned OAuth tokens are discarded after identity verification. Keep devices and browser sessions secure, sign out of shared devices and review connected accounts after suspicious activity.

Transmission and production environment

Approved HTTPS, session, access and incident controls are Verified cookies, local storage, analytics and optional tracking controls. Production deployment must be assessed separately from local development. Do not infer that every customer-generated website automatically has secure headers, TLS configuration or reviewed application code.

Payments and integrations

Payment status depends on trusted backend provider verification; card entry is handled by the applicable provider. Integration credentials and payment secrets must remain server-side. We do not claim PCI certification or that a provider’s security guarantees cover all WebMins operations. Third-party services have separate security responsibilities.

Responsible disclosure and incidents

Report suspected vulnerabilities privately to support@webmins.com, describing affected URLs, minimal reproduction and potential impact. Avoid accessing other users’ data, denial-of-service testing or destructive changes. Do not include secrets in reports. Customer account incidents can also be raised with support@webmins.com. Applicable notification and response obligations depend on the incident and law; no invented response deadline is promised.

Related policies

Terms · Privacy · Refunds · Digital delivery · AI usage · Contact