IT security policy

Encryption

All traffic between your device and our systems travels over encrypted channels. Sensitive records are encrypted at rest, and identifiers such as PAN are tokenised or hashed rather than stored in the clear.

Access control

Internal access to identity and financial records is limited by role, granted on a need-to-know basis, reviewed periodically and logged. Administrative access requires multi-factor authentication.

Logging and audit

Decision inputs, consent records and administrative actions are logged immutably so any application or account change can be reconstructed and audited.

Vulnerability management

Dependencies are monitored and patched on a defined cycle, and the platform is subject to periodic security testing. Findings are tracked to closure by severity.

Incident response

Suspected incidents follow a documented response process covering containment, assessment, regulatory notification where required, and notification to affected customers. Report a suspected vulnerability to security@advancerupay.com.

Business continuity

Data is backed up on a defined schedule with tested restoration, so servicing and repayment can continue through an outage.

How your data is protected in transit and at rest

Traffic between your device and our systems is encrypted in transit. Sensitive identifiers are stored as one-way hashes rather than in readable form — a PAN, for example, is tokenised and the raw number is never retained. Bank account numbers are stored masked.

Who inside the company can see what

Access is role-limited and granted on the least-privilege principle: support staff see what they need to answer your question and no more, and access to underwriting inputs is restricted to the people making that decision. Access is logged, and the log is reviewed rather than merely retained.

When something goes wrong

We maintain an incident response process covering detection, containment, assessment and notification. Where an incident affects your data, we notify affected users and the relevant authority as required, and we say what happened rather than describing it vaguely.

How do you vet the services you use?

Verification, payment and communication providers are assessed before integration and are contractually bound on data handling, retention and deletion. A provider cannot use what it processes for us for any purpose of its own.

What should I do if I get a suspicious message?

Only repay through advancerupay.com or the AdvanceRupay app, and never share an OTP, UPI PIN or password with anyone — including anyone claiming to be from AdvanceRupay. We will never ask for those. Report the message to us with the number it came from.

കടലാസ് ജോലിയില്ലാത്ത വായ്പ

No documentation, disbursal to your own bank account, and every charge disclosed in your Key Fact Statement before you accept.