Suffle Online

Operated by Naucera Travel Private Limited

1. Purpose

This Security & Trust Statement describes Suffle Online's security principles, operational safeguards and trust commitments for protecting customer, seller, platform and transaction information.

It is intended to provide a high-level security statement and does not disclose sensitive implementation details that could weaken Suffle's security.

2. Company and Contact

Suffle Online is operated by Naucera Travel Private Limited.

Website: www.suffleonline.com

General Support / Grievance Email: info@flyshoppy.com

Grievance Officer: Mr. Roopal Jain, Managing Director

Grievance Officer Mobile: 9707669981

Grievance Officer Email: info@flyshoppy.com

Address: 707, N. T. Road, Nalbari-781435 (Assam), India.

3. Security by Design

Suffle intends to build security into account management, marketplace operations, payments, seller workflows, connected services, AI features, documents, communications and administrative functions.

Security controls should be considered during design, development, deployment, maintenance and feature changes rather than added only after an incident.

4. Confidentiality, Integrity and Availability

Suffle's security programme is designed around protecting the confidentiality of information, preserving data and transaction integrity, and maintaining reasonable service availability.

Controls should be proportionate to the sensitivity and operational importance of the information or system involved.

5. Access Control

Suffle should use authentication and server-side authorisation to restrict access to accounts, records, documents, seller information, administrative functions and connected services.

Access should follow least-privilege principles and should be limited to the permissions necessary for the relevant function.

6. Customer and Seller Isolation

Customer data and seller data must remain logically separated.

A seller must not be able to access another seller's private records or unrelated customer data.

Customer-facing search and account functions must not expose private seller compliance documents, credentials or confidential business information.

7. Super Admin Security

Super Admin functions should use strong authentication, role-based access, restricted permissions and audit logging.

Administrative access should be limited to authorised personnel with a legitimate business need.

Sensitive administrative actions should be traceable to the responsible account or role.

8. Authentication Security

Suffle should use secure authentication mechanisms appropriate to the account and feature.

Authentication credentials, recovery mechanisms and session identifiers should be protected against unauthorised access, theft, replay and misuse.

Users should not share passwords or authentication codes.

9. Sensitive Credentials

Suffle must not intentionally expose or store prohibited sensitive credentials in ordinary application records, AI context, documents or communications.

This includes passwords, OTPs, UPI PINs, CVV, ATM PINs and banking passwords where Suffle's security architecture prohibits their storage or disclosure.

Payment authentication should remain within appropriate secure provider/payment mechanisms.

10. Encryption

Suffle should use appropriate encryption or equivalent protective controls for sensitive information in transit and, where appropriate, at rest.

Specific cryptographic algorithms, keys, infrastructure details and security configurations should not be publicly disclosed where doing so would create avoidable security risk.

11. Session and Token Security

Session identifiers, OAuth tokens, API credentials and other secrets should be securely stored, scoped, rotated or revoked as appropriate.

Tokens should not be exposed to AI, sellers, customers, support personnel or client-side interfaces unnecessarily.

Disconnected or expired connections should no longer provide unauthorised access.

12. Payment Security

Marketplace and WhatsApp software subscription payments are handled as separate financial flows using Suffle's configured payment architecture and Razorpay where applicable.

Suffle should rely on server-side verification, webhook validation, signature verification, idempotency and duplicate-event protection for payment processing.

Suffle must not store prohibited card or banking authentication secrets.

13. Order and Payment Integrity

An order is confirmed only after the payment is successfully completed and server-side verified where payment is required.

Frontend success messages, browser events, screenshots or AI-generated statements are not sufficient evidence of successful payment.

Fulfilment and seller settlement eligibility must not be triggered by an unverified payment state.

14. Data Minimisation

Suffle should collect and process only information reasonably necessary for the stated service or lawful purpose.

Unnecessary sensitive information should not be requested or retained.

15. Privacy and Security

Security and privacy are complementary controls. Personal data should be protected through appropriate access controls, secure processing, retention controls and incident response.

Personal-data practices are described in the Privacy Policy and Account Deletion & Data Retention Policy.

16. Document Security

Uploaded documents, PDFs, screenshots, seller compliance files and customer customization files should be protected through access controls, secure storage, malware/file checks and appropriate retention controls.

Private documents must not be exposed through unrestricted public links or unauthorised search.

17. Malware and File Protection

Suffle should use appropriate malware scanning, file validation and storage controls for uploaded content where technically applicable.

Suspicious or unsafe files may be rejected, quarantined or restricted.

18. Connected Apps and Accounts

Connections to external services should use legitimate authentication and authorisation mechanisms.

Suffle must not bypass provider security such as CAPTCHA, MFA, OTP or other access controls.

Connection tokens should be scoped, protected and revocable.

19. Gmail and Email Security

Where Gmail or another mailbox is connected, Suffle should use supported secure authorisation methods rather than requesting a mailbox password where OAuth or another secure method is available.

Email and imported attachments should be processed according to the authorised scope and protected against unauthorised access.

20. AI Security

Suffle AI should operate within the same account, permission and data-isolation boundaries as the underlying platform.

AI must not be given unnecessary access to secrets, credentials or unrelated private records.

Prompt-based attempts to bypass permissions, expose system secrets or access another user's information are prohibited.

21. AI Accuracy and Trust

Suffle AI may assist with classification, extraction, recommendations, summaries, product information and tracking, but AI output is not automatically verified fact.

AI must not fabricate payments, orders, refunds, tracking, availability, prices, certifications, seller approvals or other material information.

Important actions and decisions should rely on verified system records and appropriate human confirmation.

22. Automated Tracking Security

The central AI Tracking Engine should maintain controlled access to orders, bookings, shipments, documents and other tracking information.

Tracking sources and processing states should be auditable where appropriate.

Automated tracking must not be represented as live unless the underlying source genuinely provides current information.

23. Secure Development

Suffle should incorporate secure software-development practices, code review, dependency management, secrets protection, input validation, error handling and appropriate security testing.

Security-sensitive changes should be reviewed before production deployment.

24. Vulnerability Management

Suffle should identify, assess, prioritise and remediate security vulnerabilities according to risk.

Critical or high-risk issues should receive appropriate priority and mitigation.

Third-party dependencies should be monitored and updated where security fixes are required.

25. Logging and Auditability

Suffle should maintain appropriate logs for authentication, administrative activity, payment events, important account changes, security events and other sensitive operations.

Logs should be protected against unauthorised modification and access.

Logging should support investigation without unnecessarily collecting sensitive data.

26. Monitoring and Detection

Suffle may use automated security controls and monitoring to detect suspicious login activity, fraud, abuse, unusual access patterns, malicious files or other security risks.

Security signals may trigger additional verification, temporary restrictions or human investigation.

27. Backup and Recovery

Suffle should maintain appropriate backups and disaster-recovery mechanisms for critical systems and data.

Backups should be protected with appropriate access controls and security safeguards.

Recovery processes should be tested and maintained according to operational risk.

28. Business Continuity

Suffle should plan for service interruptions, infrastructure failures, provider outages, security incidents and other events that may affect availability.

Continuity measures should prioritise critical account, payment, order and security functions.

29. Incident Response

Suffle should maintain an incident-response process for suspected or confirmed security incidents.

The process may include detection, containment, investigation, remediation, recovery, documentation and appropriate notification.

Personal-data incidents should also be handled according to applicable privacy and legal requirements.

30. User Notification

Where a security incident materially affects users and notification is required or appropriate, Suffle may provide information through an appropriate communication channel.

Notifications should be based on verified incident information and should avoid unnecessary disclosure of security-sensitive details.

31. Responsible Disclosure

Suffle encourages responsible reporting of suspected security vulnerabilities through its designated support or security-reporting channel.

Researchers should provide sufficient technical information to reproduce and assess the issue and should avoid accessing, modifying or disclosing other users' data.

Unauthorised exploitation, data extraction or disruption is not permitted.

32. Third-Party Security

Suffle may rely on third-party providers for payment processing, hosting, email, AI, analytics, communication, storage, security and other services.

Where appropriate, Suffle should assess relevant security, privacy and contractual controls for such providers.

Third-party providers may have their own security limitations and availability risks.

33. Provider Availability

Security and service availability may depend partly on third-party infrastructure or provider services.

Suffle does not guarantee uninterrupted availability or that every external provider will remain available or compatible indefinitely.

34. Seller Security Responsibilities

Sellers are responsible for protecting their Suffle account, maintaining accurate business information, controlling their own staff access and securely handling customer information they legitimately receive.

Sellers must not share customer data outside authorised purposes or attempt to bypass Suffle's security controls.

35. Customer Security Responsibilities

Customers should use strong unique credentials, protect authentication codes, keep devices reasonably secure and report suspicious account activity promptly.

Customers should verify important payment, order and communication information and avoid entering credentials through suspicious links.

36. Security of Communications

Suffle should protect email, messaging, support and in-platform communications using appropriate controls.

Email and ordinary communications should not be treated as a secure channel for passwords, OTPs, UPI PINs, CVV, ATM PINs or banking passwords.

37. Security of Shipping and Labels

Suffle-generated shipping labels should contain only the information necessary for fulfilment and identification.

Labels must not expose unnecessary private information and must use actual order/shipment data.

Seller and customer information should be isolated by the relevant seller sub-order.

38. Security of Marketplace Search

Universal Search and marketplace search must enforce backend authorisation.

Search must not become a mechanism for discovering private customer documents, seller compliance files, confidential business data or unrelated account information.

39. Security of Manual and Custom Orders

Manual seller-created orders and customised-product requests must use the same central Order, Payment, Fulfilment and Refund security controls as ordinary marketplace orders.

Customer-uploaded customization files should remain access-controlled and tied to the relevant order/request.

40. Fraud Prevention

Suffle may use automated and human fraud-prevention controls for accounts, payments, orders, refunds, referrals, reviews, seller activity and messaging.

Fraud controls may temporarily restrict activity while Suffle investigates suspicious behaviour.

41. Security and Account Suspension

Suffle may temporarily restrict or suspend an account, connection, listing or feature where necessary to protect users, data, payments or platform security.

Where appropriate, users may use available support or grievance mechanisms to request review.

42. Security Limitations

No internet-connected service can guarantee absolute security.

Suffle's security measures are intended to reduce risk, but users should understand that security incidents, provider failures, device compromise and other events may still occur.

This Statement should not be interpreted as a guarantee of breach-free operation.

43. Security Transparency

Suffle aims to provide meaningful information about its security practices without publishing details that could materially assist attackers.

Technical security architecture, credentials, secrets, internal detection rules and sensitive infrastructure details may therefore not be publicly disclosed.

44. Relationship with Other Policies

This Statement should be read with the Terms & Conditions, Privacy Policy, Data Security & Protection Policy, Acceptable Use Policy, Connected Apps & Accounts Policy, Gmail / Email Data Policy, Document Policy, Suffle AI Terms, AI Tracking / Automated Processing Notice and Grievance Redressal Policy.

45. Policy Updates

Suffle may update this Statement as security practices, infrastructure, threats, providers, AI capabilities or legal requirements change.

The current effective version should be maintained through Suffle's central legal/policy management system.

46. Legal and Implementation Note

This Statement describes Suffle's intended security and trust framework. Actual controls should match the live technical architecture, infrastructure, providers, access roles, incident procedures and security testing practices.

Security and personal-data practices should be implemented consistently with applicable Indian law and regulatory requirements.

This Statement should be reviewed by qualified Indian technology, cybersecurity, privacy and e-commerce counsel before publication and periodically thereafter.

Critical Security & Trust Commitments

·       Use server-side authentication and authorisation; cookies, frontend state and AI prompts are never substitutes for access control.

·       Keep customer, seller and administrative data isolated and protected by least-privilege access.

·       Never intentionally store or expose passwords, OTPs, UPI PINs, CVV, ATM PINs or banking passwords through ordinary platform records or communications.

·       Verify marketplace and subscription payments server-side before confirming payment-dependent outcomes.

·       Protect connected-service tokens and revoke access when connections are disconnected or no longer authorised.

·       Use one central security, logging and incident-governance framework rather than duplicate security systems for individual modules.

·       Do not publish sensitive security architecture, credentials or internal controls that could create avoidable security risk.

·       No security measure guarantees absolute protection; users should report suspected compromise promptly.

Security Reporting Contact

Support / Grievance Email: info@flyshoppy.com

Grievance Officer: Mr. Roopal Jain, Managing Director

Mobile: 9707669981

Website: www.suffleonline.com

Address: 707, N. T. Road, Nalbari-781435 (Assam), India.

Related Suffle Policies

·       Terms & Conditions

·       Privacy Policy

·       Data Security & Protection Policy

·       Acceptable Use Policy

·       Connected Apps & Accounts Policy

·       Gmail / Email Data Policy

·       Document Policy

·       Suffle AI Terms

·       AI Tracking / Automated Processing Notice

·       Grievance Redressal Policy

·       Account Deletion & Data Retention Policy

Security Governance Requirement

The production platform should maintain central security governance covering identity and access management, secrets, encryption, logging, monitoring, vulnerability management, incident response, backups, provider risk, secure development and administrative actions. Security events and sensitive administrative changes should be traceable and reviewable without unnecessarily exposing personal or confidential information.