Security

DuruVault ("DuruVault", "DURU", "we", "us", or "our") is committed to protecting the security, confidentiality, integrity, and availability of information entrusted to our platform.

This Security Policy describes the administrative, technical, and organizational safeguards DuruVault uses to help protect accounts, documents, verification information, and other data processed through our Services.

1. Security Principles

DuruVault is designed around the following security principles:

• Privacy by design
• Security by design
• Least-privilege access
• Data minimization
• Controlled sharing
• Authentication and authorization
• Continuous monitoring
• Secure development practices
• Protection against unauthorized access
• Responsible incident response

2. Account Security

DuruVault provides security controls designed to help protect user accounts, which may include:

• Password-based authentication
• Multi-factor authentication where available
• Passkeys where available
• Session management
• Device and access controls
• Account security notifications
• Authentication monitoring
• Secure account recovery procedures

Users are responsible for protecting their authentication credentials and should immediately report suspected unauthorized access.

3. Document Security

DuruVault is designed to protect documents and files stored within user vaults. Security measures may include:

• Access controls
• Authorization checks
• Secure file handling
• File validation
• Protected storage
• Controlled document access
• Audit and security logging
• Secure document-sharing mechanisms

Access to private documents is intended to be limited to authorized users and parties expressly permitted by the account owner, subject to applicable law and the operation of the Services.

4. Encryption and Data Transmission

DuruVault uses appropriate security technologies designed to protect information during transmission and, where supported by the applicable infrastructure, while stored.

We use secure communication protocols and other safeguards appropriate to the sensitivity of the information being processed.

Specific encryption technologies and configurations may change as our infrastructure and security practices evolve.

5. Access Control

DuruVault applies access-control principles designed to limit access to information and systems based on legitimate business and operational requirements. Access may be restricted according to:

• User identity
• Account permissions
• Role
• Service requirements
• Administrative authorization
• Security requirements

DuruVault seeks to limit internal access to user information to personnel and service providers who require such access to perform authorized functions.

6. Secure Document Sharing

DuruVault may provide controlled document-sharing features designed to allow users to share information without exposing an entire vault. Depending on the available feature, controls may include:

• Expiring access links
• Password-protected sharing
• View-only access
• Download controls
• Access permissions
• Link revocation
• Access activity records

Users should carefully verify recipients before sharing sensitive information.

Once a user intentionally shares information with another person or organization, DuruVault cannot control what that recipient may subsequently copy, photograph, download, disclose, or retain.

7. DuruVerify Security

DuruVerify is designed to provide controlled verification of documents, records, identities, or other information using the verification methods supported by DuruVault. Verification systems may use:

• Verification identifiers
• Integrity checks
• Verification timestamps
• Status information
• Access controls
• Audit records
• Verification expiration or revocation mechanisms

A verification result does not constitute an unconditional guarantee of identity, authenticity, future validity, character, conduct, professional qualifications, or performance unless specifically stated by the applicable verification method.

8. Data Integrity

DuruVault uses reasonable safeguards designed to protect stored information against unauthorized alteration, destruction, or manipulation. Where applicable, security mechanisms may include:

• Integrity checks
• Audit logs
• Access controls
• Version or activity tracking
• Secure storage mechanisms
• Backup and recovery procedures

9. Security Monitoring

DuruVault may monitor systems and security events to identify and respond to:

• Unauthorized access attempts
• Account takeover attempts
• Fraud
• Malicious activity
• Automated abuse
• Unusual activity
• Security vulnerabilities
• System anomalies

Security logs may be retained for an appropriate period based on security, operational, legal, and compliance requirements.

10. File and Malware Protection

DuruVault may use technical controls designed to identify or restrict potentially harmful files, malicious content, or unauthorized file types.

Users must not upload malware, malicious code, or files intended to compromise DuruVault or another user's system.

No automated security system can guarantee that every malicious file or threat will be detected.

11. Backups and Recovery

DuruVault may maintain backups and recovery mechanisms designed to support service continuity and recovery from certain technical or security incidents.

Backup systems may be subject to separate retention periods and security controls.

Backups are not intended to replace a user's responsibility to maintain independent copies of particularly important documents where appropriate.

12. Third-Party Security

DuruVault may use carefully selected third-party providers for infrastructure and services such as:

• Cloud hosting
• Secure storage
• Authentication
• Payments
• Identity verification
• Document processing
• Communications
• Analytics
• Security monitoring
• AI services

DuruVault seeks to use appropriate contractual and technical safeguards when working with third-party service providers.

Third-party providers may maintain their own security policies and controls.

13. Privacy and Security of Analytics

DuruVault may use analytics and similar technologies to understand system performance and product usage.

Where technically available, sensitive information should be excluded or masked from analytics and session-recording systems.

DuruVault will take reasonable measures to prevent passwords, authentication codes, private document contents, and other highly sensitive information from being unnecessarily captured through analytics technologies.

14. Employee and Administrative Security

Where applicable, personnel with access to DuruVault systems or information may be subject to:

• Access restrictions
• Confidentiality obligations
• Security procedures
• Role-based permissions
• Security awareness requirements
• Account management controls

Access should be limited to what is reasonably necessary for authorized responsibilities.

15. Security Development Practices

DuruVault seeks to incorporate security throughout the development and maintenance lifecycle of its Services. Security practices may include:

• Authentication and authorization testing
• Input validation
• Dependency management
• Vulnerability monitoring
• Secure coding practices
• Security testing
• Error handling
• Access-control testing
• Security reviews
• Incident-response preparation

16. Incident Response

DuruVault maintains procedures designed to identify, investigate, contain, mitigate, and recover from suspected security incidents. Depending on the nature and severity of an incident, DuruVault may:

• Investigate affected systems;
• Restrict or suspend affected accounts;
• Revoke sessions or access tokens;
• Preserve relevant security logs;
• Remediate vulnerabilities;
• Restore affected services;
• Notify appropriate parties;
• Cooperate with law enforcement or regulators where legally required.

17. Data Breach Notification

If DuruVault experiences a security incident involving personal information, we will assess the incident and take appropriate action in accordance with applicable law.

Where notification is legally required, DuruVault will notify affected individuals, regulators, law-enforcement authorities, or other parties within the time and manner required by applicable law.

18. Responsible Disclosure

DuruVault encourages responsible reporting of suspected security vulnerabilities.

If you believe you have identified a security vulnerability affecting DuruVault, please report it through our designated security contact: SECURITY@DURUVAULT.COM.

Please do not publicly disclose a suspected vulnerability before giving DuruVault a reasonable opportunity to investigate and address it.

19. User Security Responsibilities

Security is a shared responsibility. Users should:

• Use a strong, unique password;
• Enable multi-factor authentication or passkeys where available;
• Protect authentication devices;
• Keep recovery information secure;
• Avoid sharing account credentials;
• Verify recipients before sharing documents;
• Report suspicious activity promptly;
• Keep devices and browsers reasonably secure;
• Log out of shared or public devices;
• Review account activity when available.

20. Security Limitations

DuruVault takes security seriously, but no internet-connected system, cloud infrastructure, software, or electronic transmission can be guaranteed to be completely secure.

Accordingly, DuruVault does not claim that its Services are immune from every possible security threat, vulnerability, unauthorized access attempt, data loss event, or cyberattack.

We continuously evaluate and improve our security practices as threats and technology evolve.

21. Security Updates

Security controls and technologies may be updated, replaced, or improved as DuruVault develops. We may modify our security practices when necessary to address:

• Emerging threats
• Vulnerabilities
• Regulatory requirements
• Technology changes
• Operational requirements
• Improvements to the Services

22. Security and Privacy Relationship

This Security Policy should be read together with the DuruVault Privacy Policy, Terms of Use, Cookie Policy, DuruVerify terms, and other applicable policies.

The Privacy Policy explains how personal information is collected and processed, while this Security Policy describes the general safeguards used to protect information.

23. Changes to This Security Policy

DuruVault may update this Security Policy periodically. The "Last Updated" date identifies the current version.

Material changes may be communicated through the Services, website, email, or another appropriate method where required.

24. Contact Us

Security-related questions or vulnerability reports may be directed to:

• DuruVault / DURU LLC
• DURU NEW YORK
• 711 Seagirt Avenue
• SECURITY@DURUVAULT.COM
• Privacy-related matters: PRIVACY@DURUVAULT.COM
• General support: support@duruvault.com