Security Policy

Our Commitment to Security

AMJID Solution LLC is deeply committed to maintaining the highest standards of information security. We understand that the trust our clients place in us is earned through rigorous security practices, transparent policies, and continuous improvement.

This Security Policy outlines the measures we take to protect our systems, data, and the information entrusted to us by our clients, partners, and users. Security is not a one-time effort but an ongoing process that permeates every aspect of our operations.

Data Protection Measures

Encryption at Rest and in Transit

All data transmitted between client applications and our servers is encrypted using TLS 1.2 or higher. Data stored at rest is encrypted using AES-256 encryption. Our encryption practices include:

• TLS 1.2+ for all HTTPS connections
• AES-256 encryption for data at rest
• Regular key rotation and management
• Secure key storage using hardware security modules (HSMs) where applicable
• Certificate pinning for mobile applications

Regular Security Audits

We conduct regular security audits to identify and address potential vulnerabilities. Our audit program includes:

• Quarterly internal security reviews
• Annual third-party penetration testing
• Continuous automated vulnerability scanning
• Code review processes for all software changes
• Compliance audits against industry standards

Access Controls and Authentication

We implement strict access controls to ensure that only authorized personnel can access sensitive data and systems:

• Multi-factor authentication (MFA) for all internal systems
• Role-based access control (RBAC) with least privilege principle
• Regular access reviews and deprovisioning of unused accounts
• Strong password policies and secure password hashing (bcrypt/Argon2)
• Session management with automatic timeout and invalidation

Application Security

Secure Coding Practices (OWASP Top 10)

Our development team follows secure coding practices aligned with the OWASP Top 10 guidelines. Security is integrated into every stage of the software development lifecycle (SDLC), from design through deployment.

Input Validation and Sanitization

All user inputs are validated and sanitized on both the client side and server side. We employ whitelisting approaches for input validation and use parameterized queries to prevent injection attacks.

CSRF Protection

Cross-Site Request Forgery (CSRF) protection is implemented across all state-changing operations. We use anti-CSRF tokens and verify the Origin and Referer headers to prevent unauthorized actions.

SQL Injection Prevention

We prevent SQL injection attacks through:

• Use of prepared statements and parameterized queries
• ORM-based database interactions where possible
• Input validation and output encoding
• Regular database security reviews
• Least privilege database user accounts

XSS Protection

Cross-Site Scripting (XSS) attacks are mitigated through comprehensive output encoding, Content Security Policy (CSP) headers, HTTPOnly and Secure flags on cookies, and regular security testing to identify XSS vulnerabilities.

Infrastructure Security

Cloud Hosting Security

Our infrastructure is hosted on reputable cloud platforms that maintain industry-standard security certifications including SOC 2 Type II and ISO 27001. We leverage built-in security features such as DDoS protection, Web Application Firewalls (WAF), and managed security services.

Firewall Protection

Multi-layered firewall protection is implemented across our infrastructure, including network firewalls, application firewalls, and host-based firewalls. Firewall rules are regularly reviewed and updated to reflect the current security posture.

Regular Backups

We maintain comprehensive backup procedures to ensure data integrity and availability:

• Daily automated backups of all critical data
• Geographically distributed backup storage
• Regular backup integrity testing and verification
• Defined retention policies aligned with compliance requirements

Disaster Recovery

Our disaster recovery plan ensures business continuity in the event of a major incident. The plan includes defined Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO), documented procedures for failover and recovery, and regular disaster recovery testing and drills.

Payment Security

PCI DSS Compliance Considerations

While AMJID Solution LLC does not directly handle or store payment card data, we ensure that our payment processing meets applicable PCI DSS requirements through our trusted payment partners.

Stripe/PayPal Secure Processing

All payment transactions are processed through industry-leading payment processors, Stripe and PayPal, which maintain the highest levels of PCI DSS compliance. These platforms provide:

• End-to-end encryption for all payment data
• Tokenization of card information
• Fraud detection and prevention tools
• 3D Secure authentication for additional verification

No Storage of Payment Card Data

AMJID Solution LLC does not store, process, or transmit credit card numbers, CVV codes, or other sensitive payment card data on our servers. All payment information is handled exclusively by our PCI-compliant payment processors.

Data Breach Response

In the event of a data breach, AMJID Solution LLC is committed to a swift and transparent response. Our incident response plan includes:

• Detection and identification: Automated monitoring and alerting systems to detect potential breaches
• Containment: Immediate steps to contain the breach and prevent further unauthorized access
• Assessment: Thorough investigation to determine the scope and impact of the breach
• Notification: Prompt notification to affected individuals and relevant authorities as required by law
• Remediation: Implementation of corrective measures to prevent recurrence
• Documentation: Comprehensive documentation and post-incident review

Affected parties will be notified within 72 hours of discovering a breach, in compliance with applicable data protection regulations.

Vulnerability Reporting

We welcome and encourage responsible disclosure of security vulnerabilities. If you discover a potential security issue in our products or services, please follow the steps below:

How to Report Security Issues

1. Send an email to contact@amjid-solution.com with the subject line "Security Vulnerability Report"
2. Include a detailed description of the vulnerability, including steps to reproduce
3. Provide the potential impact and severity assessment
4. Include your contact information for follow-up communication

We request that reporters do not publicly disclose vulnerabilities until we have had sufficient time to investigate and remediate the issue. We are committed to working collaboratively with security researchers and will credit responsible reporters in our security advisories.

Third-Party Services

AMJID Solution LLC utilizes third-party services for various operational needs. We carefully evaluate the security practices of all third-party providers before engagement and on an ongoing basis. Our third-party security assessment includes:

• Review of security certifications and compliance attestations
• Evaluation of data handling and privacy practices
• Contractual security requirements and data processing agreements
• Regular reassessment of third-party security posture

Third-party service providers are contractually obligated to maintain appropriate security measures and to notify us promptly of any security incidents that may affect our data or our clients' data.

Employee Security

All AMJID Solution LLC employees and contractors with access to systems or data are required to:

• Complete security awareness training upon hiring and annually thereafter
• Adhere to the company's information security policies and procedures
• Use multi-factor authentication for all system access
• Report security incidents and suspicious activities immediately
• Maintain confidentiality of client and company data
• Follow secure development practices as applicable to their role

Background checks may be conducted for employees in positions with access to sensitive data or critical systems.

Policy Updates

This Security Policy is reviewed and updated regularly to reflect changes in the threat landscape, technology, and regulatory requirements. Material changes will be communicated through our website and, where appropriate, directly to affected clients.

The "Last updated" date at the top of this page indicates when the most recent changes were made.

Contact

For questions about this Security Policy, to report a security vulnerability, or for any security-related inquiries, please contact us:

AMJID Solution LLC
30 N Gould St Ste N, Sheridan, WY 82801, United States
Email: contact@amjid-solution.com
Web: https://amjid-solution.com