Security

Every ChandigarhRide account is protected by phone number or email verification and one-time passcodes (OTPs) rather than a static password you have to remember and reuse. We monitor for unusual sign-in patterns and may prompt for re-verification when we detect activity that looks out of the ordinary.

Sign-in relies on OTPs delivered to your verified phone number or email, session tokens that expire and rotate, and server-side checks on every authenticated request. Ride Captains go through an additional document-based verification step before their account is activated for accepting rides.

Data sent between the ChandigarhRide app and our servers is encrypted in transit using industry-standard TLS. Sensitive fields, such as payment references, are handled through our payment partners’ encrypted systems rather than stored on our own servers in plain form.

Our mobile and web clients communicate with backend services over authenticated, encrypted API connections. Requests are validated and rate-limited, and access tokens are scoped so that a client can only perform the actions it needs for the account it is signed in as.

Card and UPI payments are processed by established, regulated payment gateway partners. ChandigarhRide does not store full card numbers or UPI credentials on its own servers; payment data is tokenized and handled according to the relevant payment industry security standards maintained by our payment partners.

Internal access to systems holding user data is restricted to employees and contractors who need it to do their job, follows the principle of least privilege, and is reviewed periodically. Sensitive actions are logged and access can be revoked immediately when someone changes role or leaves the team.

Our infrastructure runs on reputable cloud providers with network segmentation, firewalls and hardened server configurations. Backups and configuration changes follow a controlled process to reduce the risk of accidental exposure or data loss.

We log authentication events, administrative actions and system errors, and use automated alerts to flag suspicious activity such as repeated failed logins, unusual traffic patterns or anomalous data access, so our team can investigate quickly.

We track dependency and platform vulnerabilities, apply security patches on a prioritized basis, and review code changes before release. Reports received through our responsible disclosure channel (below) are triaged, reproduced and remediated according to severity.

If we identify or are notified of a security incident affecting user data, we investigate promptly, contain the issue, and notify affected users and relevant authorities where required by applicable law. Our incident response process is reviewed and improved after every significant event.

• Never share your OTP, password or full card details with anyone — including someone claiming to be from ChandigarhRide.
• Only download the ChandigarhRide app from official app stores.
• Use a lock screen on your phone and keep your app updated to the latest version.
• Verify Captain and vehicle details shown in the app before starting a ride.
• Report anything suspicious through our Report Fraud page.

We welcome reports from security researchers who discover a vulnerability in the ChandigarhRide Platform. Please act in good faith: avoid accessing, modifying, deleting or exposing data that isn’t your own, avoid degrading service for other users, and give us a reasonable amount of time to investigate and remediate before disclosing an issue publicly.

Report vulnerabilities through our Report a Security Issue form, or email chdride@gmail.com. We do not currently operate a paid bug bounty program, but we review and credit valid, responsibly disclosed reports.