Primal AITES Pvt. Ltd. treats the confidentiality, integrity and availability of its systems and information as important. This public Security Policy summarises our security approach and provides a channel for responsibly reporting suspected vulnerabilities affecting primeaites.com or another asset that Prime AITES expressly confirms is in scope.
1. Security approach
We apply safeguards proportionate to the nature of our services and risks. Depending on the system and deployment, these may include secure development and review practices, least-privilege access, multi-factor authentication, encryption in transit and at rest where appropriate, secrets management, environment separation, logging and monitoring, vulnerability and dependency management, backups, incident response, staff awareness, supplier diligence and periodic control review. The exact controls for a customer service are governed by its architecture, risk assessment and contract.
2. Reporting a vulnerability
If you believe you have identified a security weakness, email contact@primeaites.com. Machine-readable reporting details are also published at /.well-known/security.txt. If we publish a PGP key or secure submission form, use that channel for sensitive technical details. The initial report should include:
- The affected host, URL, product or version and the date and time observed.
- A clear description, potential impact and reproducible steps.
- Minimal proof such as request/response excerpts, screenshots or test data, with personal data and secrets redacted.
- Whether any data, account or system may have been accessed and what actions you took.
- Your contact details and whether you wish to be acknowledged publicly.
Do not include an unencrypted exploit package, malware, credentials or unnecessary personal data in an initial email. We may request additional information through an appropriate secure channel.
3. Good-faith research expectations
To reduce harm while we investigate, please:
- Use only accounts and data you own or have explicit permission to test.
- Stop immediately if you access personal data, confidential information, credentials or another user’s account, and report what occurred without copying, changing, retaining or disclosing more than necessary.
- Do not perform denial-of-service, destructive testing, social engineering, phishing, physical intrusion, malware deployment, persistence, credential stuffing, mass automated scanning, spam, extortion or disruption.
- Do not alter or delete data, degrade availability, bypass payment, affect production users, or exploit a weakness beyond the minimum needed to demonstrate it.
- Keep the issue confidential until we confirm remediation or agree on coordinated disclosure.
- Comply with applicable law and any written scope or testing instruction we provide.
4. Scope
Unless we publish a more specific scope, only primeaites.com and subdomains demonstrably controlled by Prime AITES are potentially eligible for coordinated disclosure. Third-party platforms, customer-controlled deployments, social-media accounts, employee devices, vendors and services not controlled by Prime AITES are out of scope. If ownership is uncertain, ask before testing.
5. Commonly excluded reports
- Missing headers or best-practice observations without a demonstrable security impact.
- Self-XSS, clickjacking on pages with no sensitive action, or logout/session observations with no practical exploit.
- Rate-limit, username-enumeration, SPF/DKIM/DMARC or TLS configuration observations without material impact.
- Reports generated solely by automated scanners, outdated browser findings, or vulnerabilities requiring obsolete unsupported software.
- Public information, expected functionality, speculative issues, or third-party vulnerabilities with no demonstrated effect on a Prime AITES-controlled asset.
6. Our response
We aim to acknowledge a sufficiently detailed report within 3 business days, provide an initial triage update within 15 business days, and share progress when reasonably possible. Resolution time depends on severity, complexity, vendor dependencies and risk. These are targets, not warranties or service-level commitments. We may combine duplicate reports and may be unable to disclose confidential remediation details.
7. Recognition and rewards
This Policy does not create a bug-bounty programme or promise payment, reward, employment, waiver, safe harbour or public recognition. Any recognition or reward is entirely at Prime AITES’ written discretion. Researchers must not demand payment or threaten disclosure.
8. Responsible disclosure and legal position
We value good-faith reports made in accordance with this Policy. Nothing here authorises access prohibited by law, creates permission to test a third party, or waives any right of Prime AITES or another person. We will assess conduct in context and may take action where testing is reckless, harmful, unlawful or outside the stated expectations. If you are unsure whether an action is permitted, contact us and obtain written confirmation before proceeding.
9. Security incidents involving personal data
Suspected unauthorised access, data exposure, account compromise or security incidents should be reported immediately to contact@primeaites.com. Do not send exposed personal data in ordinary email. Prime AITES will assess notification and response obligations under applicable Indian law, including requirements of CERT-In and the data-protection framework, as and when applicable.
10. Policy updates
We may update this Policy as our systems, products, threat environment and legal obligations evolve. The version posted on this website is the current public policy.