Incident Mitigation Framework

Data Breach & Incident Policy

Procedures established by CoverMantra Services Private Limited for identifying, containing, managing, and notifying relevant statutory bodies in the event of an information security breach.

Effective: Sept 24, 2025•Version: 1.0•CIN: U46109DL2024PTC438732

Purpose & Institutional Commitment

The purpose of this Data Breach Policy is to establish a rigorous, structured approach for identifying, reporting, containing, and mitigating any event that compromises the confidentiality, integrity, or availability of consumer, partner, or corporate data. CoverMantra is committed to immediate remediation in compliance with RBI Digital Lending directives, CERT-In statutory timelines, and DPDP mandates.

Operational Scope

All Employees, Advisors, and Contractors

Personal, Demographic, and Financial KYC Data

Production Servers, APIs, and Isolated VPS

Cloud Infrastructure and Partner Integrations

Definition of a Data Breach

A data breach is any confirmed, attempted, or suspected incident that leads to unauthorized access, accidental alteration, disclosure, exfiltration, or destruction of sensitive personal or financial information.

Critical Classifications:

• Unauthorized access to database clusters
• Credential exposure or account hijack
• Accidental leakage of borrower KYC files
• Ransomware or malicious zero-day exploits

6-Phase Incident Response Lifecycle

1. Identification

Automated telemetry flags anomalous traffic or intrusion attempts.

2. Containment

Immediate isolation of affected network nodes and session token revocation.

3. Forensic Audit

Root cause analysis, ledger verification, and affected record quantification.

4. Notification

Mandatory dispatch to CERT-In, RBI nodal contacts, and impacted borrowers.

5. Eradication

Patch deployment, vulnerability remediation, and clean snapshot restoration.

6. Post-Mortem

Publishing statutory prevention log and strengthening firewalls.

Statutory Preparedness & Audits

CoverMantra mandates quarterly vulnerability assessments and penetration testing (VAPT) performed by CERT-In accredited security firms. All customer data pipelines operate on zero-trust architectures with strict role-based access control (RBAC).

Emergency Incident Reporting Desk

Report a Security Vulnerability

If you are a security researcher, lender partner, or customer suspecting unauthorized data access, please immediately contact our emergency incident team:

Security Officer

Incident Response Desk

CoverMantra Services Pvt. Ltd.

Urgent Hotline

+91 97295 09967

24x7 Critical Severity Channel

Security Email

info@covermantra.in

PGP encrypted submissions welcomed

All Security Policies Privacy Framework

Registered Entity:
CoverMantra Services Private Limited
CIN: U46109DL2024PTC438732

Statutory Mandate:
CERT-In Directions under Section 70B of IT Act, 2000.

Zero Consumer Fee:
No fees or penalties are ever levied on users following reporting.