Security

1. How the website is protected

• Encrypted connections: every page and form uses HTTPS, and browsers are told to use HTTPS only (HSTS).
• Keys stay on the server: the forms send data to the site's own server code, which writes to our business systems. The access keys are held only on the server and never appear in a web page.
• Only what we need: the forms ask only for what we need to answer you, and personal data is never put in web addresses.
• Spam and abuse protection: every form is checked again on our server, and repeated requests from one address are limited.
• Browser protections: a content security policy blocks plug-ins and insecure content, and a strict referrer policy is applied.

2. Payments and bank details

• We never ask for card details or bank log-ins on this website, or by email, phone or WhatsApp.
• Where online payment is offered, it is made only on the secure payment page linked from your GridMats invoice.
• Pay only into the bank account printed on the GridMats invoice. We never change our bank details by email or WhatsApp. If a message asks you to pay into a different account, call +91 63626 46287 before you pay.

3. Look out for impersonation

Our team writes from @gridmats.com and @groundreality.org addresses, and our quotes and invoices come through Zoho Books. If a message in our name looks wrong, such as an urgent payment request, new bank details or an unexpected attachment, do not act on it. Forward it to security@gridmats.com.

4. How we handle data inside GridMats

• Keys for our business systems are held on servers, never in documents, email or chat.
• Access to customer data is limited to the people who need it for your project.
• Personal data is handled as our Privacy Policy sets out.

5. Reporting a vulnerability

If you find a security problem on www.gridmats.com, email security@gridmats.com with the details and the steps to reproduce it. We will acknowledge your report and keep you informed. Please give us reasonable time to fix it before you disclose it. Do not access other people's data, disrupt the service or use social engineering. We will not take action against good-faith research that follows these rules. Our contact for researchers is also published at /.well-known/security.txt.