Security Policy

Scope

Trolly Ecommerce Pvt. Ltd. manages security for the WebMins platform, including accounts, projects, provider connections and digital fulfilment. Customer-created websites and their external deployments also need independent review. This statement describes verified application controls and the approved production environment; it is not a security certification.

Verified application controls

The application checks authenticated access tokens against active user records, supports refresh sessions and checks staff permissions server-side. Password authentication uses stored hashes. Project operations are associated with the authenticated owner. Saved AI API credentials use authenticated encryption and are not returned as plaintext in ordinary connection responses.

OAuth and sessions

ChatGPT identity linking uses PKCE, one-time state, nonce and browser binding, with signature, issuer and audience validation. Returned OAuth tokens are discarded after identity verification. Keep devices and browser sessions secure, sign out of shared devices and review connected accounts after suspicious activity.

Transmission and production environment

Approved HTTPS, session, access and incident controls are Reviewed application controls include hashed passwords, expiring/revocable server-side browser sessions, HttpOnly SameSite=Lax session cookies, origin checks for browser mutations, server-side active-user/role and project-owner checks, encrypted saved AI API keys, OAuth state/PKCE/nonce verification, sanitised CMS content and trusted payment verification. Production cookie settings require HTTPS/Secure cookies; the public WebMins reference uses HTTPS, but infrastructure, backups and all customer deployments are not certified by this policy. Report incidents privately to support@webmins.com; support will investigate, contain and make legally required notifications. No ISO, SOC, PCI certification or universal availability/security guarantee is asserted.. Production deployment must be assessed separately from local development. Do not infer that every customer-generated website automatically has secure headers, TLS configuration or reviewed application code.

Payments and integrations

Payment status depends on trusted backend provider verification; card entry is handled by the applicable provider. Integration credentials and payment secrets must remain server-side. We do not claim PCI certification or that a provider’s security guarantees cover all WebMins operations. Third-party services have separate security responsibilities.

Responsible disclosure and incidents

Report suspected vulnerabilities privately to support@webmins.com, describing affected URLs, minimal reproduction and potential impact. Avoid accessing other users’ data, denial-of-service testing or destructive changes. Do not include secrets in reports. Customer account incidents can also be raised with support@webmins.com. Applicable notification and response obligations depend on the incident and law; no invented response deadline is promised.

Related policies

Terms · Privacy · Refunds · Digital delivery · AI usage · Contact

Customers in India and the United States

WebMins serves customers in India and the United States from its Indian operating company. The published business address and support channel apply to both regions; no separate US office is represented. Applicable mandatory consumer and privacy rights remain available regardless of the currency or governing-law clause. Features, gateway availability and tax treatment depend on the actual offering and checkout.