Admin Privacy & Data Governance Policy
This internal and platform governance charter defines the security baselines, access control policies, audit logging standards, and customer PII handling protocols binding all system administrators, managers, and operational operators across the Maa Ambika ecosystem.
1Administrative Access & Role-Based Access Control (RBAC)
Administrative privileges to the Maa Ambika backend database, production orders, payout ledgers, and KYC document stores are strictly segregated by role:
- Super Administrator: Full root privileges, access audit logs, API key rotation, payout batch approvals.
- Operations Manager: Order assignment, partner dispatch, rider route coordination, support resolution. PII is masked where possible.
- Finance Executive: Settlement approval, GST invoices, merchant commissions, bank reconciliation. No access to device inspection logs or personal photos.
- Quality Inspection Lead: Device test reports, IMEI blacklist verification, DoD sanitization certificates.
2Customer PII & KYC Safeguards
Strict Privacy Rules for Platform Admins:
- Aadhaar numbers must remain masked (first 8 digits hidden: `XXXX-XXXX-1234`) in compliance with UIDAI guidelines.
- Customer phone numbers and physical addresses are only accessible during active order fulfillment.
- Exporting customer database lists, bulk phone dumps, or transaction records to unauthorized local disks is strictly prohibited and logged.
3Audit Trails & Tamper-Proof Logging
Every administrative action—including order price overrides, coupon creation, partner wallet adjustments, payout dispatches, and user role updates—is recorded with timestamp, authenticated user email, IP address, and changed payload.
Audit logs are immutable, retained for a minimum of 36 months, and subject to regular quarterly security reviews.
4Database Encryption & Infrastructure Security
The platform infrastructure enforces the following technical baselines:
- Encryption at Rest: MongoDB Atlas and Supabase database volumes encrypted with AES-256.
- Encryption in Transit: Strict HTTPS/TLS 1.3 encryption across all client-to-server and inter-service communications.
- Session Expiry: Idle admin sessions automatically timeout after 60 minutes of inactivity.
- API Token Governance: Secrets and private keys (ImageKit, MongoDB, Supabase service roles) are stored exclusively in environment variables and never checked into source control.
5Statutory Law Enforcement Requests
Maa Ambika cooperates with verified Indian law enforcement agencies and cyber crime cells regarding stolen electronics (IMEI tracking, CEIR portal synchronization, and police recovery requests). Such information is released strictly upon receipt of formal section 91/102 CrPC notices or official cyber police communications.
Security & Data Protection Officer (DPO)
dpo@maaambika.in / security@maaambika.in
Admin Helpdesk: +91 8260120467
Central Security Cell, Maa Ambika Shop, Mumbai, Maharashtra 400001