Security & Trust Policy

1. Overview & Security Philosophy

WinToday operates a technology platform facilitating asset-backed daily return investment plans for eligible Indian investors. We treat system integrity, operational predictability, and data confidentiality as fundamental obligations. Our security framework combines cryptographic protection, structured multi-tier verification workflows, and strict least-privilege administrative access controls.

Unlike automated payment gateways that blindly credit deposits without human or ledger reconciliation, WinToday incorporates dual-layer verification: programmatic validation combined with manual settlement verification by trained operations personnel. This policy describes the technical controls and safeguards actively deployed across our mobile applications, web portals, and server infrastructure.

2. Account Security & Authentication

Investor accounts are safeguarded through layered client and server-side controls designed to prevent unauthorized access and credential compromise:

• Cryptographic Password Hashing: Investor passwords are never stored in plaintext. Passwords are irreversibly hashed server-side using modern Bcrypt key derivation with adaptive work factors, making credential dictionaries and rainbow tables computationally impractical.
• Tokenized API Sessions (Laravel Sanctum): Authenticated mobile sessions issue high-entropy, cryptographically random bearer tokens. Tokens are validated on every API request and scoped specifically to investor privileges.
• Mobile Security Pin & Biometrics: The WinToday Android application incorporates mandatory secondary PIN authentication and native device biometrics (fingerprint and face biometric unlock) to prevent local device compromise or shoulder surfing.
• Device Token Tracking: WinToday registers unique Firebase Cloud Messaging (FCM) device identifiers linked to active investor sessions. This allows detection of anomalous multi-device concurrency and ensures operational alerts reach the authorized physical device.
• Session Invalidation: Users may terminate active sessions on demand. Passwords updates and security-related state transitions trigger immediate token invalidation across active mobile sessions.

3. Secure Communications & Data in Transit

All communications between the WinToday mobile app, the administrative portal, and backend server endpoints occur exclusively over encrypted Transport Layer Security (TLS 1.2 or TLS 1.3) channels using HTTPS.

• Encryption in Transit: Plaintext HTTP requests are strictly rejected and redirected to secure HTTPS endpoints. All payloads, including authentication tokens, profile details, and payment slips, are encrypted while traversing public networks.
• CORS & Request Filtering: Strict Cross-Origin Resource Sharing (CORS) controls prevent unauthorized cross-domain scripting, restricting API interactions strictly to designated mobile and web clients.
• Rate Limiting & Abuse Prevention: Authentication and sensitive transaction endpoints are protected by server-side rate limiters to mitigate automated brute-force password guessing, credential stuffing, and denial-of-service attempts.

4. Access Controls & Staff Authorization

WinToday enforces stringent separation between public investor access and internal administrative functions through role-based access control (RBAC):

• Isolated Administrative Portal: Administrative features are housed under a strictly gated portal protected by dedicated authentication guards (can:admin.access) and account status verification (user.active). Investors cannot access administrative endpoints regardless of request parameters.
• Least-Privilege Authorization: Internal personnel are granted access strictly on a need-to-know basis. Only authorized compliance officers may inspect KYC identity dossiers, and only designated treasury staff may approve payment receipts and process withdrawals.
• Session Re-Authentication: Administrative sessions are bound to secure cookies with strict anti-CSRF token verification and automatic inactivity timeouts.

5. Data Masking & Information Protection

To minimize the impact of accidental screen exposure or unauthorized data viewing, WinToday employs automated, programmatic data masking across databases and API responses:

• Masked PAN Numbers: Permanent Account Numbers are transformed in API outputs and administrative overviews into masked formats (e.g., ABCDE••••F), displaying only necessary characters for record identification.
• Masked Aadhaar References: Aadhaar numbers and DigiLocker references are never serialized in plain text. Displays show strictly masked identifiers (e.g., ••••••••1234 or XXXX XXXX 9012). Raw 12-digit Aadhaar numbers and biometric fingerprints/iris data are never collected, stored, or processed on WinToday servers.
• Masked Bank Accounts: Bank account numbers are concealed in regular displays (e.g., ••••••••5678), showing only trailing digits to verify account selection.
• Protected File Storage: Uploaded identity documents (PAN cards, KYC verification files, payment receipt screenshots) are stored on private filesystem disks isolated from direct public web access. Previews require authenticated, permission-checked server proxying.

6. Payment Verification & Escrow Safeguards

Financial deposits and payouts on WinToday follow an audited, non-automated reconciliation pipeline designed to prevent fraud, synthetic deposits, and duplicate claims:

• Manual Banking Pipelines: Deposits are conducted via authorized Indian banking channels (Unified Payments Interface - UPI, Immediate Payment Service - IMPS, or National Electronic Funds Transfer - NEFT) directly into designated platform escrow accounts.
• UTR & Receipt Verification: When submitting an investment request, the investor must input the official 12-digit Unique Transaction Reference (UTR) generated by their banking application and upload the transaction receipt screenshot.
• Dual-Factor Operational Matching: WinToday financial operations personnel match the submitted UTR and receipt amount against verified bank account credits. Only when actual bank credit is confirmed is the investment record transitioned from Pending to Active.
• Prevention of Duplicate Claims: The system enforces unique transaction reference validation to prevent the reuse of historical or counterfeit UTRs across accounts.
• Withdrawal Whitelisting: Payouts are permitted solely to verified primary Indian bank accounts registered in the investor’s legal name matching verified KYC identity documents. Third-party disbursements are strictly prohibited.

7. Audit Logging & System Traceability

WinToday maintains comprehensive system audit logs (AuditLog and Activity) capturing significant administrative and financial actions:

• Timestamped logging of every KYC status change (submission, review, approval, rejection with stated rationale).
• Immutable payment status history (PaymentStatusHistory) logging the exact administrator ID responsible for approving or rejecting deposits.
• Withdrawal lifecycle tracing (WithdrawalStatusHistory) tracking submission, operational review, settlement references, and payout confirmation.
• Investor profile and bank account modification logs recording IP addresses, user agents, and chronological timestamps.

8. Prohibited Practices & Account Integrity

WinToday actively screens for malicious and fraudulent activities. The platform reserves the right to immediately freeze or permanently block accounts (UserStatus::Blocked) exhibiting:

• Submission of forged, doctored, or third-party identity documents or bank account proofs.
• Recycling or fabricating counterfeit payment UTR numbers.
• Creation of synthetic, duplicate, or nominee-disguised multiple accounts by a single beneficial owner.
• Automated scraping, reverse engineering of mobile APIs, or denial-of-service attempts.

9. Certification & Regulatory Scope Disclaimer

Transparent Operational Statement: WinToday is committed to truth in advertising and legal accuracy:

• WinToday makes no unverified claims of third-party cybersecurity certifications such as ISO/IEC 27001, SOC 2 Type II, or PCI-DSS unless independently audited, formally accredited, and publicly published with current certificate numbers.
• WinToday is a private technology platform. It is not registered as a bank, non-banking financial company (NBFC), mutual fund, or stockbroker with the Reserve Bank of India (RBI) or the Securities and Exchange Board of India (SEBI).
• While we deploy rigorous technical safeguards, no internet-connected platform can promise absolute or infallible defense against all conceivable cyber incidents, hardware failures, or network disruptions.

10. Security Contact & Vulnerability Reporting

We welcome responsible disclosure from security researchers and investors who identify potential technical vulnerabilities or operational weaknesses. To report a security vulnerability or unauthorized account activity:

• Security Desk Email: support@wintoday.app
• Subject Line: [SECURITY VULNERABILITY] - Brief Description
• Details to Include: Step-by-step reproduction steps, affected endpoints, and sample payload. Please do not access or tamper with data belonging to other investors.
• Acknowledgment: Our engineering team reviews reported vulnerabilities within 24–48 operational hours.