Security Overview 

1. Purpose of this Security Overview

The purpose of this document is to provide customers, partners, vendors, enterprise buyers, auditors, and website visitors with a clear overview of Galla.app’s security approach. 

This document explains: 

1. Our security governance approach. 
2. How we protect customer data. 
3. How we manage access control. 
4. How we secure SaaS applications. 
5. How we secure infrastructure and hosting. 
6. How we handle backups and continuity. 
7. How we manage vulnerabilities. 
8. How we manage incidents. 
9. How we protect integrations and APIs. 
10. How we support hardware security. 
11. What customers are responsible for. 
12. What security-related limitations apply. 

This document is a public security summary. Detailed internal security procedures, infrastructure diagrams, audit reports, penetration test reports, and technical control documents may be shared with eligible enterprise customers under NDA, where available and applicable. 

2. Security Commitment 

Treewalker Digital Private Limited is committed to maintaining reasonable and appropriate security controls for Galla.app. 

Our security objectives are to: 

1. Protect customer data from unauthorised access. 
2. Protect the confidentiality, integrity, and availability of the platform. 
3. Reduce risk of data loss, misuse, fraud, abuse, and unauthorised changes. 
4. Maintain secure software development practices. 
5. Monitor and respond to security issues. 
6. Support customers in using the platform securely. 
7. Maintain reasonable safeguards for SaaS, hardware, APIs, integrations, and support operations. 
8. Continuously improve security practices based on business, technology, regulatory, and customer requirements. 

3. Security Scope

This Security Overview applies to: 

1. Galla.app SaaS platform. 
2. Retail Management module. 
3. POS Billing module. 
4. Warehouse Management System module. 
5. Inventory Management module. 
6. WhatsApp Marketing module. 
7. Ecommerce Development and Managed Ecommerce Services. 
8. Third-party integrations. 
9. APIs and webhooks. 
10. Dashboards and reports. 
11. Customer support and implementation services. 
12. Cloud infrastructure used for Galla.app. 
13. Application security processes. 
14. Data protection controls. 
15. Hardware support processes where hardware is supplied by or through Treewalker Digital Private Limited. 

4. Security Governance

Treewalker Digital Private Limited aims to follow a risk-based approach to information security. 

Security governance may include: 

1. Security ownership and accountability. 
2. Internal security policies and procedures. 
3. Employee confidentiality obligations. 
4. Access control reviews. 
5. Vendor and subprocessor reviews. 
6. Incident response process. 
7. Secure development practices. 
8. Backup and recovery procedures. 
9. Vulnerability management. 
10. Security awareness and training. 
11. Periodic review of technical controls. 
12. Customer-facing security documentation. 

Where applicable, our security programme may be aligned with recognised security practices such as ISO 27001-style information security management, OWASP application security practices, secure software development, and Indian cybersecurity requirements. 

Galla.app should not be considered ISO 27001 certified, SOC 2 compliant, or independently certified unless such certification or audit report is expressly published or shared by Treewalker Digital Private Limited. 

5. Customer Data Protection

Galla.app processes customer data required for retail, billing, warehouse, inventory, ecommerce, WhatsApp marketing, integrations, and business operations. 

Customer data may include: 

1. Business account information. 
2. User information. 
3. Product data. 
4. Customer records. 
5. Vendor records. 
6. Employee/user records. 
7. POS billing records. 
8. Invoice details. 
9. Payment status. 
10. Inventory records. 
11. Warehouse movement data. 
12. Barcode, QR code, RFID, batch, or serial number data. 
13. Ecommerce order data. 
14. WhatsApp campaign and communication data. 
15. API logs. 
16. Integration logs. 
17. Support tickets. 
18. Attachments and troubleshooting data. 

We use reasonable technical and organisational safeguards to protect customer data from unauthorised access, misuse, loss, alteration, or disclosure. 

7.  Access Control 

Access control is one of the most important parts of Galla.app security. 

Galla.app may support role-based access controls depending on the subscribed module and configuration. 

Access controls may include: 

1. Admin users. 
2. Role-based permissions. 
3. Store-level access. 
4. Warehouse-level access. 
5. Company-level access. 
6. User-level restrictions. 
7. Module-level permissions. 
8. Report access restrictions. 
9. Data export permissions. 
10. Integration access control. 
11. API key control. 
12. Activity logs, where available. 

Customers are responsible for configuring user access properly.

8. Customer User Management 

Customers are responsible for managing users inside their Galla.app account. 

Customers should: 

1. Create only authorised users. 
2. Assign minimum required access. 
3. Avoid shared accounts. 
4. Avoid shared admin passwords. 
5. Remove users who leave the organisation. 
6. Remove users who no longer need access. 
7. Review active users periodically. 
8. Restrict admin access. 
9. Protect login credentials. 
10. Enable multi-factor authentication where available. 
11. Protect API keys and integration tokens. 
12. Report suspicious activity immediately. 

Treewalker Digital Private Limited is not responsible for unauthorised access caused by customer-side weak passwords, credential sharing, compromised devices, inactive users, exposed API keys, or internal misuse. 

9. Authentication and Password Security 

Galla.app may use authentication controls to help protect account access. 

Authentication practices may include: 

1. Unique user accounts. 
2. Password-based login. 
3. Session management. 
4. Password reset process. 
5. User access controls. 
6. Account activity tracking. 
7. Admin-controlled user management. 
8. Multi-factor authentication, where available. 
9. Login security monitoring, where available. 

Customers should ensure that all users use strong passwords and do not reuse passwords across multiple services. 

Recommended customer password practices: 

1. Use strong and unique passwords. 
2. Do not share passwords. 
3. Do not send passwords over email, WhatsApp, or chat. 
4. Change passwords when compromise is suspected. 
5. Remove inactive users. 
6. Use password managers where possible. 
7. Enable MFA where available. 
8. Immediately report unauthorised access. 

10. Administrative Access

Treewalker Digital Private Limited may require limited administrative access to customer accounts for support, implementation, troubleshooting, security investigation, migration, or maintenance. 

Administrative access is intended to be: 

1. Limited to authorised personnel. 
2. Used only for legitimate business purposes. 
3. Subject to internal confidentiality obligations. 
4. Used for support, implementation, troubleshooting, security, or service delivery. 
5. Restricted based on role and need. 
6. Logged or monitored where available and appropriate. 

Customers should avoid sharing unnecessary sensitive data or passwords during support. 

If temporary credentials are shared with support teams, the customer should rotate or revoke such credentials after support completion. 

11. Application Security 

Galla.app is designed and maintained with application security practices appropriate for a SaaS platform. 

Application security measures may include: 

1. Secure coding practices. 
2. Code review, where applicable. 
3. Input validation. 
4. Authentication controls. 
5. Authorisation controls. 
6. Session management. 
7. Protection against common web application attacks. 
8. Error handling. 
9. Logging and monitoring. 
10. Vulnerability management. 
11. Security testing. 
12. Secure API design. 
13. Secure integration handling. 
14. Controlled deployment process. 
15. Change management. 

We aim to consider common security risks such as injection, broken access control, authentication weaknesses, sensitive data exposure, security misconfiguration, vulnerable dependencies, logging gaps, and API abuse. 

12. API and Webhook Security 

Galla.app may provide APIs, webhooks, integration credentials, or developer tools. 

API security practices may include: 

1. API authentication. 
2. API keys or tokens. 
3. Access control for API usage. 
4. Rate limits where applicable. 
5. Logging of API activity. 
6. Secure transmission. 
7. Key rotation where required. 
8. Restriction of exposed credentials. 
9. Monitoring of abnormal usage. 
10. Revocation of compromised keys. 

Customers using APIs must: 

1. Keep API keys confidential. 
2. Never expose API keys in public repositories. 
3. Never share access tokens with unauthorised persons. 
4. Use APIs only for authorised business purposes. 
5. Follow applicable rate limits. 
6. Validate data before relying on it. 
7. Secure connected systems. 
8. Report exposed keys immediately. 
9. Remove unused API credentials. 
10. Avoid using APIs for scraping, spam, fraud, or unauthorised automation. 

13. Data Transmission Security 

Galla.app uses reasonable safeguards to protect data transmitted between users and the platform. 

Data transmission security may include: 

1. HTTPS/TLS encryption for web access. 
2. Secure API communication. 
3. Secure connection to third-party services where supported. 
4. Restricted access to production systems. 
5. Protection against unauthorised interception where feasible. 
6. Secure communication for support channels where available. 

Customers should access Galla.app only through secure networks and updated browsers. 

Customers should avoid using public or insecure Wi-Fi for admin access, billing data, warehouse data, customer records, or sensitive operations. 

14. Data Storage Security 

Galla.app uses cloud-based infrastructure and storage systems to support SaaS operations. 

Data storage safeguards may include: 

1. Access-controlled databases. 
2. Restricted infrastructure access. 
3. Logical separation of customer accounts. 
4. Secure backup processes. 
5. Limited access by authorised personnel. 
6. Monitoring and logging, where available. 
7. Infrastructure security controls provided by cloud vendors. 
8. Storage security based on platform architecture. 

Customers with specific data residency, encryption, or compliance requirements should contact Treewalker Digital Private Limited before deployment. 

15. Cloud Infrastructure Security 

Galla.app may be hosted on cloud infrastructure provided by trusted cloud service providers. 

Cloud security controls may include: 

1. Network security controls. 
2. Server access restrictions. 
3. Infrastructure monitoring. 
4. Backup storage. 
5. Cloud provider security controls. 
6. Controlled administrative access. 
7. Security group or firewall configuration. 
8. Logging and monitoring. 
9. Deployment controls. 
10. Periodic review of infrastructure settings. 

Treewalker Digital Private Limited relies on cloud providers for certain physical, environmental, network, and infrastructure-level security controls. 

A current Subprocessor List should identify the cloud and infrastructure providers used by Galla.app. 

16. Network and Environment Security 

Treewalker Digital Private Limited may use controls to protect production systems and development environments. 

These may include: 

1. Restricted access to production systems. 
2. Separation of environments where feasible. 
3. Controlled deployment process. 
4. Firewall and network restrictions. 
5. Secure configuration. 
6. Monitoring for suspicious activity. 
7. Limited use of production data in non-production environments. 
8. Access review for technical personnel. 
9. Protection of secrets, keys, and credentials. 
10. Review of infrastructure changes. 

17. Secure Software Development 

Galla.app aims to follow secure software development practices. 

These may include: 

1. Security consideration during design. 
2. Secure coding practices. 
3. Code review. 
4. Testing before release. 
5. Bug tracking. 
6. Vulnerability remediation. 
7. Controlled release process. 
8. Dependency review. 
9. Security review of high-risk changes. 
10. Rollback planning where feasible. 
11. Access-controlled development tools. 
12. Protection of source code repositories. 

Security is treated as part of software quality, not only as a post-release activity. 

18. Change Management 

Changes to Galla.app may include product updates, bug fixes, infrastructure changes, feature releases, security patches, configuration changes, and integration updates. 

Change management may include: 

1. Requirement review. 
2. Development review. 
3. Testing. 
4. Approval process. 
5. Deployment planning. 
6. Release notes where applicable. 
7. Monitoring after release. 
8. Rollback where feasible. 
9. Customer notification for material changes. 
10. Emergency change process for urgent issues. 

Emergency changes may be made without prior notice when required for security, stability, legal compliance, or urgent issue resolution. 

19. Vulnerability Management 

Treewalker Digital Private Limited aims to identify, assess, prioritise, and remediate vulnerabilities in a reasonable and timely manner. 

Vulnerability management may include: 

1. Internal testing. 
2. Dependency monitoring. 
3. Security review. 
4. Vulnerability scanning, where available. 
5. External penetration testing or VAPT, where conducted. 
6. Risk-based prioritisation. 
7. Patch management. 
8. Remediation tracking. 
9. Customer notification where a vulnerability materially affects customer data or service security. 
10. Responsible disclosure process. 

Critical vulnerabilities are prioritised based on risk, exploitability, customer impact, and availability of mitigation. 

20. Penetration Testing and VAPT 

Treewalker Digital Private Limited may conduct vulnerability assessment and penetration testing for Galla.app periodically or as required by enterprise customers. 

Where available, VAPT summaries or certificates may be shared with eligible enterprise customers under NDA. 

Detailed VAPT reports may contain sensitive security information and may not be published publicly. 

Customers should not perform penetration testing, vulnerability scanning, automated scanning, load testing, or security testing on Galla.app without prior written permission. 

Security researchers should follow the Responsible Disclosure Policy. 

21. Monitoring and Logging 

Galla.app may use monitoring and logging to support security, reliability, troubleshooting, and platform operations. 

Monitoring and logs may include: 

1. Login activity. 
2. User activity. 
3. API usage. 
4. Application errors. 
5. System performance. 
6. Integration events. 
7. Security events. 
8. Administrative actions. 
9. Support investigation logs. 
10. Infrastructure logs. 
11. Message delivery logs, where applicable. 
12. Warehouse or POS activity logs, where available. 

Logs may be retained for security, troubleshooting, compliance, fraud prevention, audit, or business continuity purposes. 

Customers are responsible for reviewing their own user activity and internal misuse where relevant. 

22. Backup and Recovery 

Galla.app may maintain backups to support data protection, service continuity, and recovery from certain incidents. 

Backup practices may include: 

1. Periodic backup of production systems. 
2. Backup storage in secure environments. 
3. Controlled access to backups. 
4. Backup retention based on internal policy. 
5. Recovery testing where feasible. 
6. Restoration process for operational incidents. 
7. Backup deletion or overwrite based on retention cycles. 
8. Backups are intended for platform recovery and business continuity. They are not a substitute for customer-controlled exports or legal recordkeeping. 

Customers should regularly export and retain business-critical data required for accounting, tax, legal, audit, statutory, or internal purposes. 

23. Disaster Recovery and Business Continuity 

Treewalker Digital Private Limited aims to maintain reasonable disaster recovery and continuity practices for Galla.app. 

These may include: 

1. Cloud-based infrastructure. 
2. Backup processes. 
3. Incident escalation. 
4. Emergency maintenance procedures. 
5. Recovery planning. 
6. Service monitoring. 
7. Vendor dependency review. 
8. Communication process for major incidents. 
9. Prioritisation of critical services. 
10. Restoration planning. 

Recovery time may depend on the nature of the incident, affected systems, third-party provider availability, data volume, and technical complexity. 

24.Incident Response 

Treewalker Digital Private Limited maintains an incident response approach for security events and service incidents. 

Incident response may include: 

1. Detection. 
2. Triage. 
3. Investigation. 
4. Containment. 
5. Impact assessment. 
6. Remediation. 
7. Customer notification where required. 
8. Root cause analysis where appropriate. 
9. Preventive actions. 
10. Documentation and closure. 

If a confirmed security incident affects Customer Personal Data, we will take reasonable steps to notify affected customers in accordance with applicable law, agreement, and our Incident Response Policy. 

Incident notification does not constitute admission of fault or liability. 

25. Responsible Disclosure 

Treewalker Digital Private Limited encourages responsible reporting of security vulnerabilities. 

Security researchers, customers, and users should report suspected vulnerabilities to: 

Support Email: support@treewalkerlabs.com

Reports should include: 

1. Description of vulnerability. 
2. Steps to reproduce. 
3. Affected URL or feature. 
4. Screenshots or proof-of-concept, if safe. 
5. Impact assessment. 
6. Reporter contact details. 

Researchers must not: 

1. Access or modify customer data. 
2. Disrupt services. 
3. Perform denial-of-service testing. 
4. Use automated high-volume scanning without permission. 
5. Exfiltrate data. 
6. Publicly disclose vulnerabilities before remediation. 
7. Social engineer employees or customers. 
8. Test physical security. 
9. Test third-party services not owned by Treewalker Digital Private Limited. 

Reports will be reviewed based on severity, exploitability, and impact.

26. Employee and Contractor Security

Treewalker Digital Private Limited may apply security practices for employees, contractors, and authorised personnel. 

These may include: 

1. Confidentiality obligations. 
2. Access control based on job role. 
3. Limited access to customer data. 
4. Security awareness. 
5. Review of access rights. 
6. Revocation of access after role change or exit. 
7. Internal policies for data handling. 
8. Protection of credentials. 
9. Use of approved tools. 
10. Support access controls. 

Personnel are expected to access customer data only for legitimate business purposes. 

27. Vendor and Subprocessor Security 

Galla.app may use third-party providers and subprocessors for cloud hosting, messaging, email, support, analytics, payment processing, security, monitoring, and other services. 

Vendor security practices may include: 

1. Vendor review before onboarding important subprocessors. 
2. Review of privacy and security documentation. 
3. Data processing agreements where applicable. 
4. Confidentiality obligations. 
5. Access limitation. 
6. Review of business purpose. 
7. Review of data categories processed. 
8. Periodic review where feasible. 
9. Updating the Subprocessor List for material changes. 

Customers should review our Subprocessor List for more details. 

28. Third-Party Integrations Security 

Galla.app may integrate with customer-selected third-party systems such as ERP, Tally, accounting software, ecommerce platforms, marketplaces, payment gateways, logistics providers, WhatsApp/Meta, SMS providers, email providers, analytics tools, and custom APIs. 

Customers are responsible for: 

1. Authorising third-party integrations. 
2. Maintaining third-party accounts. 
3. Securing third-party credentials. 
4. Reviewing third-party security and privacy terms. 
5. Removing unused integrations. 
6. Protecting API keys and tokens. 
7. Validating data received from third-party systems. 
8. Ensuring lawful data transfer. 
9. Monitoring third-party access. 
10. Handling third-party provider incidents. 

Treewalker Digital Private Limited is not responsible for security failures, outages, API changes, policy changes, or data processing practices of customer-selected third-party services. 

29. WhatsApp Marketing Security 

Galla.app may provide WhatsApp Marketing and customer communication tools. 

Security and responsible-use controls may include: 

1. Access control for campaign users. 
2. Contact import controls. 
3. Campaign activity logs, where available. 
4. Message status tracking. 
5. Provider integration controls. 
6. Opt-out management support, where configured. 
7. Template and campaign workflows. 
8. Monitoring of abnormal usage where feasible. 

Customers using WhatsApp Marketing are responsible for: 

1. Lawful contact collection. 
2. Consent management. 
3. Opt-out handling. 
4. Message content approval. 
5. Avoiding spam. 
6. Avoiding unauthorised contact lists. 
7. Following WhatsApp/Meta policies. 
8. Protecting campaign data and contact lists. 
9. Restricting campaign access to authorised users. 
10. Securing WhatsApp Business and provider accounts. 

30.  POS Billing Security 

For POS Billing, security controls may include: 

1. User access management. 
2. Billing counter user control. 
3. Role-based permissions. 
4. Invoice activity tracking, where available. 
5. Report access control. 
6. Export access control. 
7. Integration access controls. 
8. Support access controls. 
9. Data backup. 
10. Configuration controls. 

Customers are responsible for: 

1. Assigning POS users properly. 
2. Preventing shared cashier logins. 
3. Securing POS devices. 
4. Securing local printers and scanners. 
5. Reviewing invoice activity. 
6. Configuring GST and tax data correctly. 
7. Preventing fake billing or unauthorised invoice changes. 
8. Protecting customer phone numbers and invoice data. 

31. Warehouse Management Security 

For Warehouse Management, security controls may include: 

1. Warehouse-level access. 
2. User-level permissions. 
3. Scanner or device user mapping, where available. 
4. Activity logs, where available. 
5. Stock movement tracking. 
6. Barcode, QR, or RFID workflow controls. 
7. Role-based process access. 
8. Report access controls. 
9. Integration controls. 
10. Support investigation logs. 

Customers are responsible for: 

1. Assigning warehouse users properly. 
2. Securing handheld devices. 
3. Preventing shared logins. 
4. Removing former warehouse users. 
5. Securing scanners and RFID devices. 
6. Controlling stock adjustment permissions. 
7. Reviewing stock movement logs. 
8. Maintaining physical stock controls. 
9. Training warehouse staff. 
10. Reconciling system stock with physical stock. 

32. Ecommerce Security 

For ecommerce development and managed ecommerce services, security may depend on the ecommerce platform, hosting provider, payment gateway, plugins, themes, and integrations used. 

Security responsibilities may include: 

1. Secure admin access. 
2. Strong passwords. 
3. Restricted ecommerce admin users. 
4. Payment gateway security. 
5. Plugin and theme updates. 
6. Secure checkout configuration. 
7. HTTPS configuration. 
8. Customer data protection. 
9. Access revocation after project completion. 
10. Secure handling of product and order data. 

Customers are responsible for: 

1. Ecommerce privacy policy. 
2. Cookie consent where required. 
3. Payment gateway compliance. 
4. Admin user security. 
5. Product and order data accuracy. 
6. Marketplace and platform compliance. 
7. Security of customer-controlled ecommerce accounts

33. Hardware Security 

Galla.app may be used with hardware such as POS devices, barcode scanners, QR scanners, RFID readers, RFID antennas, handheld terminals, printers, tablets, and accessories. 

Hardware security depends on proper installation, access control, environment, and customer processes. 

Customers are responsible for: 

1. Securing physical devices. 
2. Preventing unauthorised device use. 
3. Protecting device login credentials. 
4. Removing inactive users from devices. 
5. Keeping devices in safe locations. 
6. Preventing theft, tampering, or misuse. 
7. Using supported accessories and power supplies. 
8. Avoiding unauthorised repair. 
9. Ensuring proper network security. 
10. Reporting lost or stolen devices immediately. 
11. Resetting or wiping devices before disposal or reassignment, where applicable. 
12. Maintaining device-level security updates where applicable. 

Treewalker Digital Private Limited may provide hardware support as per the SLA and Support Policy and Hardware Replacement Policy. 

34. Customer Security Responsibilities 

Security is a shared responsibility. 

Treewalker Digital Private Limited secures the Galla.app platform within its control. Customers must secure their own people, devices, users, accounts, networks, data, integrations, and business processes. 

Customers must: 

1. Use strong passwords. 
2. Avoid sharing credentials. 
3. Remove inactive users. 
4. Restrict admin access. 
5. Review user permissions. 
6. Secure devices and local networks. 
7. Protect API keys. 
8. Protect third-party credentials. 
9. Enable MFA where available. 
10. Train employees. 
11. Use secure internet connections. 
12. Keep browsers and devices updated. 
13. Avoid uploading unnecessary sensitive data. 
14. Avoid exporting data to insecure locations. 
15. Report suspicious activity immediately. 
16. Follow the Acceptable Use Policy. 
17. Follow the WhatsApp Marketing Policy. 
18. Maintain lawful consent and privacy notices. 
19. Verify reports and outputs before relying on them. 
20. Maintain physical and operational controls for POS and warehouse processes.

35.  Data Export Security 

Galla.app may allow export of reports, invoices, customer lists, inventory data, warehouse records, ecommerce records, WhatsApp campaign data, and other business records. 

Customers are responsible for securing exported data. 

Customers should: 

1. Export data only when required. 
2. Limit export access. 
3. Store exported files securely. 
4. Avoid sharing exported data over insecure channels. 
5. Delete unnecessary exports. 
6. Avoid sending exports to unauthorised users. 
7. Protect exported personal data. 
8. Use encryption for sensitive exports where possible. 
9. Maintain audit trails for critical exports where possible. 
10. Comply with data retention and deletion laws. 

Treewalker Digital Private Limited is not responsible for misuse of data after it is exported by the customer or authorised users. 

36.  Data Retention and Deletion Security 

Customer Data may be retained for the period necessary to provide services and as required for legal, tax, accounting, audit, security, backup, dispute, and compliance purposes. 

Data deletion may be subject to: 

1. Active subscription status. 
2. Payment clearance. 
3. Legal retention requirements. 
4. Tax and accounting rules. 
5. Backup cycles. 
6. Security investigations. 
7. Ongoing disputes. 
8. Customer instructions. 
9. Technical feasibility. 
10. Data Retention and Deletion Policy. 

Customers should review our Data Retention and Deletion Policy for more details. 

37. Privacy and Security 

Privacy and security are connected but separate. 

Security focuses on protecting systems, accounts, infrastructure, and data from unauthorised access, misuse, loss, or compromise. 

Privacy focuses on lawful, fair, transparent, and responsible processing of personal data. 

Galla.app’s privacy and security practices are described across: 

1. Privacy Policy. 
2. Data Processing Addendum. 
3. Subprocessor List. 
4. Security Overview. 
5. Data Retention and Deletion Policy. 
6. Incident Response Policy. 
7. Responsible Disclosure Policy. 
8. Acceptable Use Policy. 
9. WhatsApp Marketing Policy. 

38. Compliance Readiness 

Galla.app may maintain or work toward security and compliance practices aligned with recognised frameworks and customer requirements. 

These may include: 

1. ISO 27001-aligned information security practices. 
2. OWASP-aligned application security practices. 
3. Secure software development practices. 
4. VAPT or penetration testing, where conducted. 
5. CERT-In aligned incident handling practices, where applicable. 
6. DPDP-ready privacy and data protection practices. 
7. Vendor and subprocessor review. 
8. Enterprise security questionnaires. 
9. Internal access control reviews. 
10. Security awareness processes. 

39. Security Documentation for Enterprise Customers 

Eligible enterprise customers may request additional security documentation. 

Depending on availability and approval, we may provide: 

1. Security overview. 
2. Privacy overview. 
3. DPA. 
4. Subprocessor List. 
5. SLA and Support Policy. 
6. Data retention summary. 
7. VAPT summary or certificate, where available. 
8. Security questionnaire responses. 
9. Architecture summary, where appropriate. 
10. Incident response summary. 
11. Backup and recovery summary. 
12. Compliance roadmap, where applicable. 
13. Detailed documents may require NDA and internal approval. 

We do not provide unrestricted access to source code, production systems, unrelated customer data, internal credentials, confidential architecture diagrams, or sensitive security information. 

40.Security Limitations 

No SaaS platform, cloud service, network, application, or internet-based service can be guaranteed to be completely secure. 

Treewalker Digital Private Limited uses reasonable safeguards, but cannot guarantee that: 

1. The platform will always be free from vulnerabilities. 
2. All attacks can be prevented. 
3. Third-party providers will never experience incidents. 
4. Customer-side credentials will never be compromised. 
5. Customer-side devices will always remain secure. 
6. Customer users will never misuse access. 
7. Internet or cloud services will always be available. 
8. Hardware will never fail. 
9. Integrations will always remain secure or available. 
10. Data exported by customers will remain protected outside Galla.app. 

Customers must maintain their own security controls and business continuity procedures. 

41. Prohibited Security Activities 

Customers and users must not: 

1. Attempt unauthorised access. 
2. Scan or test Galla.app without written permission. 
3. Perform penetration testing without approval. 
4. Perform load testing without approval. 
5. Attempt to bypass authentication. 
6. Attempt to access other customers’ data. 
7. Share API keys publicly. 
8. Introduce malware. 
9. Conduct denial-of-service attacks. 
10. Scrape platform data. 
11. Reverse engineer Galla.app. 
12. Abuse APIs. 
13. Attempt privilege escalation. 
14. Misuse support access. 
15. Hide or tamper with audit logs. 
16. Use Galla.app to attack third-party systems. 

Violations may result in suspension, termination, legal action, and reporting to authorities where required. 

42. Reporting Security Issues 

If you believe you have found a security vulnerability or if you suspect unauthorised access to your account, contact us immediately. 

Support Email: support@treewalkerlabs.com

Please include: 

1. Description of issue. 
2. Affected account or URL. 
3. Date and time. 
4. Screenshots or logs, if available. 
5. Steps to reproduce, if reporting a vulnerability. 
6. Business impact. 
7. Contact details. 

Do not publicly disclose suspected vulnerabilities until Treewalker Digital Private Limited has had reasonable time to investigate and remediate. 

43. Customer Security Checklist 

Galla.app customers should follow this checklist: 

1. Use unique accounts for every user. 
2. Do not share login credentials. 
3. Use strong passwords. 
4. Enable MFA where available. 
5. Review admin users monthly. 
6. Remove inactive users immediately. 
7. Restrict export permissions. 
8. Protect API keys. 
9. Remove unused integrations. 
10. Use secure networks. 
11. Keep devices updated. 
12. Secure POS and warehouse devices. 
13. Train staff on phishing and data protection. 
14. Review WhatsApp campaign permissions. 
15. Keep contact lists lawful and updated. 
16. Secure customer data exports. 
17. Report suspicious activity immediately. 
18. Maintain business data backups or exports where required. 
19. Follow Galla.app policies. 
20. Keep billing and support contact details updated. 

44. Security Contact

For security-related questions, concerns, or vulnerability reports, contact: 

Treewalker Digital Private Limited
Product: Galla.app
Registered Office: Vikas Plaza.38/ 1A (4), Kanappana Agrahara, Hosur Rd, Phase II, Electronic City, Bengaluru, Karnataka 560100
Legal Email: legal@treewalkerlabs.com
Support Email: support@treewalkerlabs.com
Phone: +91-6366-740-274
CIN: U72900KA2021PTC153840
GSTIN: 29AAICT9733E1ZX 

45. Related Policies

This Security Overview should be read together with: 

1. Terms of Service. 
2. Privacy Policy. 
3. Cookie Policy. 
4. Data Processing Addendum. 
5. Subprocessor List. 
6. Acceptable Use Policy. 
7. WhatsApp Marketing Policy. 
8. Refund, Billing, Cancellation, and Hardware Replacement Policy. 
9. SLA and Support Policy. 
10. Data Retention and Deletion Policy. 
11. Responsible Disclosure Policy. 
12. Incident Response Policy.