Compliance

1. Compliance posture

Khodi Mart is built for marketplace sellers and wholesale commerce with security and privacy as product requirements — not afterthoughts. We align controls with partner expectations for OAuth, least privilege, encryption, and auditability, and we structure policies to support future SOC 2 / ISO 27001 readiness.

2. Encryption

• TLS for all production HTTPS traffic.
• AES-256-GCM (or equivalent) for marketplace OAuth refresh tokens and API secrets at rest.
• Passwords hashed with modern one-way algorithms — never stored in plaintext.

3. Secure infrastructure

• Cloud hosting with network firewall / security group controls.
• Secrets via environment variables / secret manager — never committed to git.
• Regular backups with restricted access.
• Rate limiting on APIs and marketplace workers.

4. Privacy first

• Supplier anonymity in seller discovery views.
• Seller-scoped queries for marketplace and ops data.
• MAYA uses tool allowlists — no raw SQL from the LLM.
• We do not sell personal data.

5. OAuth integration

Marketplace connections use official OAuth / partner flows. We never ask for Amazon, Flipkart, or Meesho seller passwords. Disconnect wipes encrypted credentials and stops sync.

6. Least-privilege access

• Role-based portals: seller, supplier, warehouse, admin.
• Consent scopes limited to Orders, Inventory, Listings, Returns, Settlement as applicable.
• Internal production access limited to authorised operators.

7. Regular security reviews

We review dependencies, high-severity issues, and responsible disclosure reports. Enterprise customers may request security questionnaires; responses are coordinated via support under NDA when needed.

8. Related documents

• Privacy Policy, Terms of Service, Security Policy, Cookie Policy.
• DPA for enterprise processing arrangements.
• Acceptable Use, Refund, Cancellation, and SLA.
• Trust Center, Security Center, API Security, Responsible Disclosure.

9. Contact

Compliance questionnaires: support@khodimart.com (subject “Compliance”). Security: security@khodi.in.