Security

Encrypted in Transit

Every page, price list and image on the Website is served over HTTPS, so what you read is encrypted on its way to you and cannot be altered in transit.

Nothing to Sign In To

The Website has no sign-up, no login, no forms and no payments. There are no passwords on it to steal and no database of visitors to breach.

Static by Design

Every page is built in advance and served as a static file. There is no server-side application, database or admin panel exposed to the internet, which removes the most common routes of attack.

No Third-Party Scripts

Fonts, images and code are served from the Website itself. There are no analytics, advertising or tracking scripts, and every release is checked to make sure no page loads anything from another host.

Safe Links Out

Every link that leaves the Website opens in a new tab, isolated so that the page it opens cannot control or redirect this one.

SSL / TLS Encryption

All traffic between your browser and VendorStocks is encrypted using TLS 1.3, and data at rest — documents and database records — is encrypted with AES-256. HTTPS is enforced across the platform, with HSTS to prevent protocol downgrade attacks.

Secure Authentication

Accounts are protected with securely hashed credentials, session-based access tokens, and short-lived sessions. Sign-in activity is monitored for anomalies, and passwords are never stored in plain text.

Data Protection

Role-based access control and row-level security isolate every organisation's data. Verification documents are held in access-restricted storage with audit logging, backups are encrypted, and access to production data is limited and monitored.

Vendor Verification

Sellers undergo document-based verification — PAN, GSTIN, and business registration are reviewed before activation. Verification shows that a review was completed; it is not an endorsement, and accounts are re-evaluated periodically.

Fraud Prevention

VendorStocks continuously monitors for fake listings, fraudulent transactions, and coordinated abuse, with automated safeguards, rate limiting and bot defences, and staff who investigate suspicious behaviour.

Payment Security

Payments are processed by PCI-DSS compliant gateway partners (Razorpay / PayU). VendorStocks never stores full card numbers, CVVs, UPI PINs, or net-banking credentials — sensitive payment data is handled entirely by the gateway.

How to Report

1. 01Email our security team. Send a detailed report to support@skylightsenergy.in with a subject line beginning “Security”. Include steps to reproduce, the affected URLs or endpoints, and any supporting evidence.
2. 02Give us time to investigate. We will acknowledge your report within 3 business days and work to validate and remediate confirmed issues as quickly as possible.
3. 03Disclose responsibly. Please do not publicly disclose the issue, access or modify other users' data, or degrade our service while we investigate. Acting in good faith under this policy will not result in legal action from us.

Please Avoid

• Accessing, downloading, or modifying data that does not belong to you
• Denial-of-service (DoS) testing, spam, or social engineering of our staff or users
• Automated scanning that degrades performance for others
• Publicly disclosing a vulnerability before we have resolved it