Effective Date: September 14, 2026 · Last Updated: September 14, 2026
At Vantageflow Technologies Private Limited (“Vantageflow”, “Company”, “we”, “us” or “our”), we recognize that MyLifeVault may be entrusted with highly sensitive personal information and important documents — identity documents, financial records, insurance information, property documents, family information, employment records, educational records, medical or health-related records, contracts, certificates, photographs, and other confidential information. Protecting this information is a fundamental responsibility of Vantageflow. We seek to build and operate MyLifeVault using appropriate security, privacy and resilience practices and continuously improve our security posture as the Platform evolves.
Our security program is guided by the following principles:
Security considerations are incorporated into the design and development of MyLifeVault.
Access to systems and information is restricted according to legitimate operational requirements.
We seek to use multiple layers of technical and organizational controls rather than relying on a single security mechanism.
We seek to limit unnecessary collection, access and retention of personal data.
Where appropriate, information is protected using encryption in transit and at rest.
Access to MyLifeVault and supporting systems is protected through appropriate authentication and authorization controls.
We use appropriate logging, monitoring and alerting capabilities to identify suspicious activity and security events.
We maintain processes for detecting, assessing, containing, investigating and responding to security incidents.
Security controls and practices are periodically reviewed and improved based on emerging threats, vulnerabilities, incidents and technological developments.
MyLifeVault is designed to protect User Content and personal information against unauthorized access, alteration, disclosure, destruction or loss through reasonable technical and organizational safeguards appropriate to the nature and risk of the information. Depending on the relevant system and feature, safeguards may include encryption in transit and at rest, identity and access management, least-privilege access, authentication controls, multi-factor authentication, secure session management, access logging, security monitoring, vulnerability management, secure software-development practices, backup and disaster-recovery controls, network and infrastructure security, incident response, personnel confidentiality obligations, and third-party security assessments. The specific controls implemented may evolve as MyLifeVault develops.
MyLifeVault uses cloud infrastructure and managed services to operate its application, databases, storage, security systems and supporting infrastructure. Vantageflow remains responsible for configuring and operating the portions of the environment under its control appropriately. Cloud-provider security does not eliminate the need for secure application configuration, identity management, access control, monitoring and secure software development.
Vantageflow seeks to incorporate secure-development practices throughout the MyLifeVault development lifecycle, which may include secure coding standards, code review, dependency management, vulnerability scanning, static analysis, dynamic testing, secrets management, secure configuration, authentication and authorization testing, API security testing, security testing before significant releases, and remediation of identified vulnerabilities.
Access to systems containing personal data is restricted based on legitimate business and operational requirements. Controls may include role-based access control, least-privilege permissions, privileged-access management, multi-factor authentication, administrative access restrictions, access logging, periodic access reviews, and revocation of access when no longer required.
Personnel with access to systems or information may be subject to confidentiality obligations, security policies, security awareness training, access controls, acceptable-use requirements, role-specific security requirements, and appropriate onboarding and offboarding procedures. Access is limited according to job responsibilities and revoked when no longer required.
MyLifeVault may rely on third-party providers for services including cloud infrastructure, authentication, storage, payments, communications, analytics, monitoring, customer support, AI/OCR, cybersecurity, and other technology services. Where appropriate, Vantageflow may conduct security and privacy due diligence before engaging service providers. Third-party providers may also be subject to contractual confidentiality, security and data-protection obligations.
Vantageflow may identify vulnerabilities through automated scanning, code analysis, dependency monitoring, internal security testing, penetration testing, security reviews, threat intelligence, third-party assessments, vendor notifications, and responsible-disclosure reports. Identified vulnerabilities are assessed based on factors such as severity, exploitability, affected systems, potential impact, likelihood, exposure, availability of mitigations, and risk to users. Remediation priority is determined based on the circumstances and applicable risk.
Vantageflow welcomes responsible reports from security researchers, customers, independent researchers and other members of the security community. If you believe you have discovered a security vulnerability affecting MyLifeVault, we encourage you to report it to us promptly and responsibly.
Security Contact
Email: info@vantageflowtech.com
Subject: Responsible Disclosure — [Brief Vulnerability Description]
If Vantageflow establishes a dedicated security-reporting portal in the future, reports may also be submitted through that portal.
Please report vulnerabilities that could materially affect confidentiality or integrity of user information, availability of MyLifeVault, authentication, authorization, account security, document access, API security, encryption, session security, access controls, privilege boundaries, sensitive-data exposure, payment security, or third-party integration security. Examples include authentication bypass, authorization bypass, IDOR/BOLA vulnerabilities, privilege escalation, sensitive document exposure, cross-account data access, remote code execution, significant server-side injection (including SQL injection), significant XSS, SSRF, insecure direct object access, authentication-token compromise, sensitive API exposure, and cloud-storage access-control vulnerabilities.
The responsible-disclosure channel should not normally be used for ordinary customer-support requests, forgotten passwords, account recovery, billing disputes, subscription issues, feature requests, general product feedback, complaints unrelated to security, requests for personal data, privacy-rights requests, or general technical support.
For privacy concerns, use info@vantageflowtech.com. For customer support, use info@vantageflowtech.com. For privacy grievances, see the Privacy Grievance & DPDP Rights Mechanism.
We welcome good-faith security research conducted within the boundaries of this Policy. You may perform non-destructive testing against systems that are publicly accessible and clearly within the MyLifeVault environment, provided that your testing does not access another user's data, disrupt services, destroy or modify data, degrade availability, involve social engineering of employees or users, involve physical attacks, involve credential theft, involve malware, or involve denial-of-service activity, and complies with applicable law.
Where possible, security researchers should use accounts that they own or have explicit authorization to use. Researchers should not attempt to access or test another user's account or data. If testing requires multiple accounts, researchers should create their own test accounts where the Platform permits this.
Researchers must not intentionally access, download, copy, modify, disclose or retain personal information belonging to another MyLifeVault user. If you accidentally encounter another user's information while investigating a vulnerability: stop testing the affected functionality; do not access additional information; do not download or copy the information; do not disclose the information; securely delete any accidentally obtained information where possible; and immediately report the issue to Vantageflow. Your report should contain the minimum information necessary to demonstrate the vulnerability.
Researchers must not intentionally delete user data, modify user documents, alter account information, corrupt databases, disrupt services, disable security controls, perform denial-of-service or distributed denial-of-service attacks, deploy malware, install persistent backdoors, or otherwise damage MyLifeVault.
Security testing should be conducted at a reasonable rate. Researchers should avoid excessive automated requests that could degrade service, trigger operational incidents, affect other users, consume disproportionate resources, or cause automated security systems to fail. If a vulnerability requires high-volume testing, contact the security team before conducting such testing.
The responsible-disclosure program does not authorize phishing, impersonation, pretexting, credential harvesting, or targeting employees, customers or vendors with social-engineering activity. Do not attempt to obtain passwords, OTPs, authentication tokens or other secrets from Vantageflow personnel or MyLifeVault users.
Physical security testing is not authorized under this Policy. Do not attempt to enter restricted facilities, bypass physical security, access servers or employee devices, access office networks, steal or manipulate physical equipment, or impersonate employees or contractors.
The responsible-disclosure authorization provided by Vantageflow applies only to systems that Vantageflow controls or for which it has authority to authorize testing. You must not test third-party systems, infrastructure or services merely because they are integrated with MyLifeVault — for example, Google infrastructure, payment-provider infrastructure, identity-provider infrastructure, telecommunications infrastructure, or other vendor-controlled systems. Where a vulnerability appears to originate from a third-party service, report the issue to Vantageflow with sufficient information for investigation.
Security reports may contain sensitive technical information or personal information. Vantageflow will handle submitted reports appropriately and may share information internally or with relevant service providers where necessary to investigate and remediate the vulnerability. Researchers should minimize personal information included in reports.
A useful security report should include, where available: vulnerability title; affected URL, API endpoint, application or component; vulnerability type; severity assessment; detailed description; steps to reproduce; proof of concept; screenshots or videos where useful; request/response examples where appropriate; affected account type; potential impact; suggested remediation; whether the issue is reproducible; and any relevant test-account information. Do not include passwords, OTPs, private keys or unnecessary personal information.
A proof of concept should be minimal, reproducible, non-destructive, limited to the researcher's own accounts or authorized environment, and sufficient to demonstrate the vulnerability. Do not provide a proof of concept that unnecessarily accesses real user data or causes harm.
Researchers may use the following format: Title; Affected component (URL/API/Application/Feature); Vulnerability type (e.g. Broken Access Control); Severity (Critical/High/Medium/Low); Description; Steps to reproduce; Expected result; Actual result; Impact; Proof of concept; Suggested remediation (optional); Researcher contact (email).
Vantageflow will seek to acknowledge valid security reports within a reasonable period. The acknowledgement may include a report reference number, confirmation that the report was received, initial classification, or a request for additional information. An acknowledgement does not constitute an admission that a vulnerability exists.
Vantageflow may assess submitted reports based on validity, reproducibility, severity, affected assets, exploitability, potential user impact, security implications, existing mitigations, and other relevant circumstances. Researchers may be contacted for clarification or additional evidence.
Where Vantageflow determines that a report identifies a legitimate vulnerability, we may remediate the vulnerability, deploy a mitigation, modify affected functionality, restrict access, rotate credentials or keys, invalidate sessions, improve monitoring, notify affected users where required, notify authorities where legally required, or take other appropriate measures. The timing of remediation will depend on severity, exploitability, complexity and other circumstances.
Vulnerabilities that may permit widespread unauthorized access, compromise of authentication, access to sensitive user documents, significant privilege escalation, remote code execution, large-scale data exposure, or substantial compromise of confidentiality, integrity or availability may receive accelerated investigation and remediation. Where appropriate, Vantageflow may take immediate protective measures before a permanent fix is available.
A vulnerability report may identify an ongoing security incident rather than merely a theoretical vulnerability. Where this occurs, Vantageflow may initiate its security incident-response process, which may include containment, investigation, forensic analysis, credential/session revocation, vulnerability remediation, impact assessment, legal and regulatory assessment, notification where required, and recovery and monitoring.
Researchers are requested to provide Vantageflow with a reasonable opportunity to investigate and remediate a reported vulnerability before publicly disclosing it. As a general guideline, researchers should allow at least 90 days from the date Vantageflow receives a sufficiently detailed report before public disclosure. Vantageflow may request additional time where remediation is technically complex, the vulnerability affects sensitive systems, coordinated disclosure is necessary, third-party remediation is required, or premature disclosure could materially increase risk to users. Researchers are encouraged to discuss disclosure timelines with the security team.
For significant vulnerabilities, Vantageflow may seek coordinated disclosure with the reporting researcher, affected technology providers, cloud providers, identity providers, security organizations, relevant authorities, or other affected parties. The objective is to reduce the risk of exploitation while allowing appropriate recognition of the researcher.
Researchers should not publicly disclose user information, credentials, authentication tokens, encryption keys, private documents, internal security configurations, unreleased vulnerabilities, exploit code capable of causing significant harm, or other confidential information before coordinating with Vantageflow. Nothing in this Policy is intended to restrict lawful activity that cannot legally be restricted.
Vantageflow considers good-faith security research conducted in accordance with this Policy to be authorized activity. To the extent permitted by applicable law, Vantageflow will not initiate legal action against a researcher solely for security testing that complies with this Policy, is conducted in good faith, avoids accessing or exposing other users' data, avoids disruption, avoids destruction or modification of data, respects applicable law, and is promptly reported to Vantageflow. This safe-harbor provision does not authorize conduct that violates applicable law or third-party rights.
Safe harbor does not apply to activities including accessing another user's data, stealing credentials, phishing, social engineering, denial-of-service attacks, destructive testing, malware deployment, persistence mechanisms, physical intrusion, extortion, ransomware, blackmail, threatening disclosure, cryptocurrency mining, spam, intentionally disrupting services, intentionally destroying or modifying data, attacks against third-party systems without authorization, or other unlawful activity. Vantageflow reserves all rights available under applicable law in response to malicious or unlawful activity.
Researchers are requested to keep non-public information relating to reported vulnerabilities confidential until coordinated disclosure has occurred. Vantageflow may similarly seek to protect the researcher's identity and information where appropriate, subject to legal requirements, security requirements, regulatory obligations, and the researcher's own disclosure preferences.
This Responsible Disclosure Policy does not constitute a bug-bounty program. Vantageflow does not currently promise monetary compensation for vulnerability reports unless a separate bug-bounty program or written agreement expressly provides otherwise. If Vantageflow introduces a bug-bounty program in the future, the program will have separate eligibility, scope, reward and disclosure terms.
Subject to the researcher's preference and Vantageflow's discretion, we may recognize researchers who responsibly report valid vulnerabilities — for example, through acknowledgement in a security hall of fame, written appreciation, public credit, or another appropriate form of recognition. We will not publicly identify a researcher without appropriate permission, except where required by law.
If multiple researchers report the same vulnerability, Vantageflow may treat the first sufficiently detailed and reproducible report received as the primary report for recognition purposes. This does not affect our ability to investigate or remediate all reports.
If a report does not contain sufficient information to reproduce or evaluate the issue, Vantageflow may request additional information. A report may be closed if it cannot be reproduced, insufficient information is provided, the reported behavior is expected, the issue is outside scope, or another valid reason prevents further investigation.
The following categories may generally be considered low priority or outside the responsible-disclosure program unless they demonstrate a material security impact: missing security headers without demonstrated impact; informational findings; version disclosure without exploitability; self-XSS; clickjacking on pages without sensitive actions; theoretical vulnerabilities without a realistic attack path; rate-limit findings without demonstrated abuse potential; spam-related issues; weak password recommendations without an actual vulnerability; issues requiring highly unlikely user interaction; and purely cosmetic application behavior. Vantageflow may nevertheless review any report that demonstrates a meaningful security impact.
If you discover a vulnerability involving personal data — for example, unauthorized document access, cross-user document exposure, account takeover, unauthorized data export, privacy-control bypass, unauthorized sharing, exposure of sensitive metadata, or access-control failures — please report it immediately to info@vantageflowtech.com with the subject line “URGENT — Potential MyLifeVault Privacy/Security Vulnerability.”
If you believe your own MyLifeVault account has been compromised, do not attempt to investigate by accessing suspicious systems yourself. Instead: secure your email/identity-provider account; change your password where applicable; revoke suspicious sessions where supported; enable additional authentication controls; and contact MyLifeVault support at info@vantageflowtech.com.
Security Team, Vantageflow Technologies Private Limited
Email: info@vantageflowtech.com
For urgent security matters, subject: “URGENT SECURITY INCIDENT — MyLifeVault”
Do not include passwords, OTPs, private keys or other authentication secrets in the report.
For privacy rights and personal-data concerns, or for formal privacy grievances, contact the Privacy / Grievance Team at info@vantageflowtech.com. The MyLifeVault Privacy Grievance & DPDP Rights Mechanism provides the formal procedure for exercising applicable privacy rights.
For ordinary product or account issues — login problems, document-upload problems, account questions, feature questions, and general technical support — contact info@vantageflowtech.com or use the in-app “Report a Bug” feature.
This Policy describes Vantageflow's general security and responsible-disclosure approach. It does not disclose confidential security architecture, credentials, internal network configurations, cryptographic keys, security-monitoring rules, detection mechanisms, vulnerability details or other information that could increase security risk if publicly disclosed. Security controls may change over time as the threat environment and MyLifeVault architecture evolve.
While Vantageflow takes reasonable steps to protect MyLifeVault and information processed through it, no internet-connected service can guarantee absolute security. Security is a shared responsibility. Users should also maintain secure devices, strong authentication practices and appropriate backups of critical documents.
Vantageflow may update this Security & Responsible Disclosure Policy to reflect changes in MyLifeVault, security improvements, changes in responsible-disclosure practices, regulatory developments, changes in security contacts, or changes in applicable law. The Last Updated date will indicate when this Policy was most recently revised.
Vantageflow Technologies Private Limited
Registered Office: H/O Subodh Kumar Jha, Ward No. 09, Pupri, Janakpur Road, Pupri, Sitamarhi – 843320, Bihar, India
Security: info@vantageflowtech.com
Privacy: info@vantageflowtech.com
Grievance: info@vantageflowtech.com
Customer Support: info@vantageflowtech.com
Website: https://mylifevault.co.in
This Security & Responsible Disclosure Policy is effective from the date specified at the beginning of this document.
© 2026 Vantageflow Technologies Private Limited. All Rights Reserved.