1. Security Commitment & Transparency
PPF Group of Companies (Panndu Poultry Farms & Hatcheries) operates this website as an informational catalogue showcasing certified poultry breeds, day-old chicks, hatching eggs, commercial incubators, cages, and feeds.
Although this website does not process credit card transactions or hold sensitive financial credentials, we recognize our responsibility under India's Digital Personal Data Protection Act, 2023 (DPDPA) to protect customer enquiry information (names, contact numbers, messages) from unauthorized access, loss, or alteration.
2. HTTPS & Transport Layer Security (TLS)
All user traffic between your browser and our web application is transmitted over encrypted channels:
- TLS In-Transit Encryption: Modern Transport Layer Security (TLS/HTTPS) is enforced on all domain traffic, ensuring submitted enquiry payloads and page assets cannot be read or intercepted in cleartext on intermediate networks.
- Enforced Redirection: Inbound connections using unencrypted HTTP protocols are automatically redirected to secure HTTPS endpoints.
- HTTP Security Response Headers: All responses carry defensive HTTP headers including
X-Content-Type-Options: nosniff(prevents MIME sniffing),X-Frame-Options: SAMEORIGIN(clickjacking protection),Referrer-Policy: strict-origin-when-cross-origin, andPermissions-Policy(restricting unauthorized camera/mic/geolocation hardware access).
3. Secure Handling of Customer Enquiry Data
Enquiry data submitted through our product catalogue and contact modals undergoes strict multi-layer defensive processing:
Client submissions are re-validated on the server. Input fields are trimmed of excess whitespace, HTML tags are stripped to eliminate stored XSS risks, and strict length thresholds are enforced (name ≤ 100 chars, message ≤ 2000 chars, phone 10-15 digits).
The enquiry API implements an automated 15-second deduplication lock based on matching customer phone and name, preventing accidental rapid double-clicks and repeated bot submission loops.
All database interactions utilize structured Mongoose Object-Document Mapping (ODM) models with strict schema typing, preventing arbitrary NoSQL query injection vulnerabilities.
Customer phone numbers, emails, and requirements are strictly inaccessible via any public API route. Unauthenticated GET requests to enquiry endpoints return HTTP 401 Unauthorized.
Image uploads to the catalogue require verified administrator authorization, enforce MIME-type whitelisting (JPG, PNG, WebP, GIF), enforce a strict 5MB maximum file size cap, and sanitize target filenames with timestamp entropy.
4. Authentication & Administrative Access Controls
Our administrative management portal (used internally for catalogue inventory and viewing enquiry leads) is separated from public browsing by layered controls:
/admin/*) are monitored at the server edge by Next.js middleware, immediately redirecting unauthenticated visitors to the login gate before sensitive layout or database modules can load.admin_session) are cryptographically generated using the Web Crypto API with HMAC-SHA256 signatures, ensuring tokens cannot be forged or tampered with by unauthorized parties.5. Environment Secrets & Credential Isolation
We practice strict isolation of administrative credentials and connection strings:
- Database connection URIs (
MONGODB_URI), storage tokens, and signing secret keys are maintained strictly in server-side environment configurations. - No credentials, passwords, or secret access keys are ever compiled into client-side JavaScript bundles or checked into public source repositories.
- We do not load third-party ad pixels or arbitrary tracking scripts, avoiding third-party code injection risks.
6. Implemented Safeguards vs. Continuous Roadmap
To maintain strict honesty regarding our security posture, we clearly differentiate what is currently implemented from ongoing improvements:
- HTTPS / TLS transport encryption across all routes.
- Edge middleware protecting administrative routes.
- HMAC-SHA256 cryptographically signed session tokens.
- Server-side input sanitization & length validation.
- 15-second duplicate enquiry rate defense.
- Server-side isolation of database credentials.
- Third-party penetration testing and independent audits (planned as commercial scale expands).
- Formal enterprise ISO/IEC 27001 certifications (not claimed or currently held).
- Integration of an external Web Application Firewall (WAF) rule suite.
- Automated disaster recovery backups beyond hosting provider defaults.
7. Reporting Security Incidents & Vulnerabilities
If you are a security researcher, developer, or customer who has identified a suspected vulnerability, data exposure risk, or privacy concern, we welcome your responsible disclosure:
Security Incident Report: [Brief Issue Summary]- Provide clear, step-by-step reproduction instructions to help us verify the issue promptly.
- Allow our technical team 48 to 72 business hours to acknowledge your report before sharing details publicly.
- Do not access, modify, or download other users' enquiry submissions.
- Do not execute denial-of-service (DoS) attacks or degrade ongoing farm catalogue availability.