Data Security Policy

1. Regulatory Alignment

DokaanDigit's security practices are designed with reference to:

• The Digital Security Act, 2018 (Bangladesh)

• The Information and Communication Technology Act, 2006 (Bangladesh)

• Bangladesh Bank guidelines applicable to Payment Service Providers and Mobile Financial Services integration

• bKash Payment Gateway (PGW) merchant security requirements, including mandatory SSL/TLS encryption for all integrated endpoints

2. Technical Security Measures

• End-to-end SSL/TLS encryption for all data transmitted between the App and our servers

• bcrypt hashing for all account PINs - DokaanDigit never stores PINs in plain text

• JWT (JSON Web Token) based authentication with secure, time-limited session tokens

• OTP-based phone verification for account recovery, ensuring no password reset can occur without access to the registered phone number

• Role-based access control - Merchant staff (multi-user accounts) are granted access only to the specific Shop(s) and functions assigned to them

• Encrypted database storage (MongoDB Atlas) with access restricted to authorized NTechEdge personnel only

• Regular automated backups with disaster recovery protocols

3. Payment Data Security

DokaanDigit does not directly process, transmit, or store your bKash PIN, OTP, mobile wallet password, or card numbers at any point. All such sensitive payment credentials are entered directly within bKash's own secure, PCI-DSS-aligned payment interface. DokaanDigit only receives a transaction confirmation and reference number from bKash upon successful payment - this is consistent with bKash's Tokenized Checkout and Payment Gateway architecture, under which the Merchant (NTechEdge) never has access to the Payer's underlying account credentials.

4. SMS & Notification Data Handling

• Customer phone numbers used for SMS reminders (বাকি reminder, invoice delivery) are transmitted securely to our SMS gateway provider (BulkSMSBD or equivalent) and are not shared for any other purpose

• SMS content templates are reviewed to exclude unnecessary sensitive information (e.g., full account balances are not sent via SMS beyond what is operationally necessary)

5. Incident Response

In the event of a data breach affecting your personal or business data, NTechEdge will notify affected Users via SMS, WhatsApp, or in-app notification without undue delay, and will notify relevant Bangladeshi regulatory authorities as required by applicable law.

6. User Responsibilities

• You are responsible for keeping your account PIN confidential and not sharing it with unauthorized individuals

• You must notify us immediately at support@dokaandigit.com if you suspect unauthorized access to your account

• For multi-user accounts (Business/Enterprise plans), the primary account holder is responsible for managing sub-user access permissions appropriately

7. No Absolute Guarantee

While NTechEdge implements industry-standard security measures, no method of electronic transmission or storage is 100% secure. NTechEdge cannot guarantee absolute security but is committed to promptly addressing any identified vulnerabilities.