Security at Genie Bazaar

Genie Bazaar is hosted on Amazon Web Services (AWS) in the Asia-Pacific region (primary: Mumbai ap-south-1; secondary: Singapore ap-southeast-1). AWS holds ISO 27001, SOC 1/2/3, and PCI DSS certifications.

• Virtual Private Cloud (VPC) with private subnets for application and database tiers
• Security groups and network ACLs enforce strict inbound/outbound traffic rules
• No direct internet access to database or internal services
• AWS CloudTrail and VPC Flow Logs enabled for audit and forensics
• Automated backups with point-in-time recovery; backups encrypted and tested quarterly
• 99.5% monthly uptime target with multi-AZ failover for critical services

SSL/TLS certificates are managed via AWS Certificate Manager with automatic renewal. We score A+ on SSL Labs for our production domains.

• Role-based access control (RBAC): Every user is assigned a role with the minimum permissions required (principle of least privilege).
• Multi-factor authentication (MFA): Mandatory for all administrative and privileged accounts.
• Session management: Sessions expire after inactivity; secure, HttpOnly, SameSite cookies with CSRF protection.
• Production access: Limited to a small number of engineers via VPN + SSH key; all access is logged.
• Third-party access: Sub-processors and integrations are granted the minimum OAuth scopes required.
• Offboarding: Access is revoked within 24 hours of employee termination.

• Centralised logging (application, infrastructure, access) with tamper-protected log storage.
• AWS GuardDuty for continuous threat detection and anomaly analysis.
• Automated alerts for unusual login patterns, privilege escalation, and high error rates.
• Uptime monitoring with automated failover and on-call PagerDuty rotation.
• Rate limiting and brute-force protection on all authentication endpoints.
• Web Application Firewall (WAF) protecting all public endpoints against OWASP Top 10.

• Annual penetration tests conducted by independent CREST/GPEN-certified third parties covering web application, API, and infrastructure layers.
• Automated vulnerability scanning runs on every deployment via CI/CD pipeline (SAST, DAST, SCA).
• Dependency scanning with automated alerts for CVEs in third-party packages.
• Patch management: Critical security patches applied within 48 hours; high severity within 7 days.
• Penetration test summaries available to enterprise customers under NDA on request.

We maintain a documented Incident Response Plan (IRP) with the following response SLAs:

Personal data breaches are notified to the relevant supervisory authority within 72 hours in compliance with GDPR Article 33. Affected data subjects are notified without undue delay where required.

Our Secure Development Lifecycle (SDLC) includes:

• All employees undergo background verification before joining.
• Annual security awareness training is mandatory for all staff.
• All employees and contractors sign confidentiality and data handling agreements.
• Security policies are reviewed annually or following significant incidents.
• Physical access to offices is controlled; equipment is encrypted and remotely wipeable.

Genie Bazaar's platform and operations are designed to support customers' compliance with:

Security documentation, VAPT reports, and compliance evidence can be provided to enterprise customers under NDA as part of vendor due diligence.