Security Policy

1. Scope

This Security Policy applies to the Securus website, online forms, customer and partner-facing digital services, portals and other online systems operated or controlled by Securus CCTV India Private Limited.

This Policy should be read together with our Privacy Policy, Cookie Policy, Terms & Conditions and any other policies or notices applicable to specific products or services.

2. Our Approach to Security

We follow a risk-based approach to information and cybersecurity.

Depending on the nature of the system, information and associated risks, reasonable safeguards may include:

• Access controls and authentication mechanisms
• Role-based or authorised access to internal systems
• Secure communication technologies
• Network and infrastructure security controls
• System and activity logging
• Malware and threat protection
• Software updates and security patches
• Backup and recovery measures
• Vulnerability identification and remediation
• Monitoring of systems for suspicious or unauthorised activity
• Security awareness and access-management practices

Security controls may be reviewed and updated periodically based on technological developments, identified risks, operational requirements and applicable legal or regulatory requirements.

3. Website Security

We take reasonable measures designed to protect our website and related systems from common security threats, including unauthorised access, malicious activity, malware, data manipulation and other forms of cyberattack.

Our website infrastructure may use security measures such as encrypted communications, access restrictions, server and application security controls, logging and monitoring mechanisms.

However, no website, network, electronic transmission or information system can be guaranteed to be completely secure. Users should therefore take appropriate precautions when accessing or communicating through online services.

4. Access Control

Access to Securus systems and information is restricted based on legitimate business requirements and authorised responsibilities.

Where appropriate, access may be controlled through authentication credentials, permissions, user roles or other security mechanisms.

Employees, authorised personnel, service providers and other persons with permitted access to Securus systems are expected to protect their credentials and use systems only for authorised purposes.

5. Data Security

We implement reasonable safeguards designed to protect personal data and other information under our control against unauthorised access, disclosure, alteration, loss or destruction.

Security measures are selected according to the nature of the information, the manner in which it is processed and the risks associated with such processing.

Our practices relating specifically to the collection, use, storage, sharing and protection of personal data are described in our Privacy Policy.

6. Third-Party Services

Our website and digital infrastructure may rely on third-party providers for services such as website hosting, cloud infrastructure, analytics, communication, customer support or other technology functions.

Where appropriate, we seek to use service providers that maintain reasonable security practices. However, third-party services operate under their own systems, policies and security controls, and Securus cannot guarantee the absolute security or uninterrupted availability of systems operated by third parties.

Links from our website to external websites or services are not covered by this Security Policy.

7. Security Monitoring

Securus may monitor its website, servers, networks and other digital systems for operational reliability, security threats, attempted unauthorised access, malicious activity and other security-related events.

Technical information such as IP addresses, device or browser information, timestamps, request information, access logs and security-event information may be collected or processed where reasonably necessary for security, fraud prevention, troubleshooting and protection of our systems.

Such information will be handled in accordance with applicable law and our Privacy Policy.

8. Security Incident Management

If we become aware of a cybersecurity incident affecting systems or information under our control, we may take appropriate steps to investigate, contain, mitigate and remediate the incident.

Depending on the circumstances, these measures may include:

• Investigating the nature and extent of the incident
• Restricting or disabling affected access
• Containing affected systems
• Preserving relevant security information or logs
• Correcting identified vulnerabilities
• Restoring affected services
• Reviewing security controls
• Coordinating with relevant service providers
• Making notifications or reports required under applicable law

Where applicable, cybersecurity incidents will be handled in accordance with relevant Indian laws, regulatory requirements and directions issued by competent authorities, including the Indian Computer Emergency Response Team (CERT-In).

9. Product Security

Securus designs and supplies surveillance, networking and related technology products.

The security of connected products depends not only on the product itself but also on installation, network configuration, password management, firmware or software maintenance and the security of the environment in which the product is deployed.

Customers, installers, dealers, system integrators and administrators should follow appropriate security practices, including:

• Changing default passwords or credentials where applicable
• Using strong and unique passwords
• Restricting administrative access
• Keeping firmware and software reasonably up to date
• Using secure network configurations
• Limiting unnecessary internet exposure
• Protecting associated routers, recorders, servers and network equipment
• Installing products in accordance with applicable documentation and security recommendations

Users are responsible for maintaining the security of their own networks, devices, credentials and system configurations.

10. Vulnerability Reporting

We encourage security researchers, customers, partners and other users to responsibly report suspected security vulnerabilities affecting a Securus website, service or product.

If you believe you have identified a security vulnerability, please contact Securus through our official Contact Us or Help Desk channels and provide sufficient information for us to understand and investigate the issue.

Where possible, a vulnerability report should include:

• The affected product, service or webpage
• A description of the suspected vulnerability
• Steps required to reproduce the issue
• Relevant screenshots, logs or technical details
• Potential security impact
• Contact information for follow-up, where appropriate

Please do not include unnecessary personal data, confidential customer information, passwords, authentication credentials or information obtained through unauthorised access.

11. Responsible Security Research

When investigating or reporting a suspected vulnerability, you must not:

• Access, modify, delete or download data belonging to another person without authorisation
• Attempt to obtain passwords, authentication credentials or confidential information
• Install malware or malicious software
• Conduct denial-of-service or resource-exhaustion attacks
• Perform social engineering, phishing or physical security attacks
• Disrupt our systems, services or business operations
• Exploit a vulnerability beyond what is reasonably necessary to demonstrate its existence
• Publicly disclose sensitive vulnerability details before Securus has had a reasonable opportunity to investigate and address the issue
• Engage in any activity prohibited by applicable law

This Policy does not provide permission to access systems or information for which you are not otherwise authorised.

12. Prohibited Activities

Users must not attempt to compromise the security or normal operation of the Securus website or related systems.

Prohibited activities include, without limitation:

• Attempting unauthorised access to accounts, servers, networks or databases
• Circumventing authentication or security controls
• Introducing malware, viruses or malicious code
• Scanning, probing or testing systems in a manner that causes disruption or is otherwise unauthorised
• Interfering with website availability or performance
• Attempting to obtain information through fraudulent or deceptive means
• Using automated mechanisms to abuse, overload or disrupt our services
• Modifying, damaging or deleting information without authorisation

Suspected malicious or unlawful activity may be investigated and, where appropriate, reported to relevant authorities.

13. User Security Responsibilities

Users should take reasonable precautions when accessing Securus digital services.

We recommend that users:

• Keep passwords and credentials confidential
• Use strong and unique passwords
• Keep computers, mobile devices and browsers updated
• Use trusted networks and devices
• Avoid opening suspicious links or attachments
• Verify communications that request sensitive information
• Sign out of accounts on shared or public devices
• Inform us promptly if they suspect unauthorised activity involving a Securus service

Securus will never require users to disclose passwords through unsolicited communications.

14. No Guarantee of Absolute Security

While we take reasonable measures to protect our website, systems and information, cybersecurity risks cannot be completely eliminated.

No security control, system, network, software, device or method of electronic communication can be guaranteed to be entirely secure, error-free or immune from cyber threats.

Accordingly, this Security Policy does not constitute a guarantee that security incidents, vulnerabilities, service interruptions or unauthorised activity will never occur.

15. Legal and Regulatory Compliance

Securus seeks to manage cybersecurity and information-security matters in accordance with applicable laws and regulatory requirements in India.

Where applicable, this may include requirements arising under the Information Technology Act, 2000, applicable rules and regulations, cybersecurity directions issued by CERT-In, the Digital Personal Data Protection Act, 2023, the Digital Personal Data Protection Rules, 2025, and other applicable laws or regulatory requirements, as amended from time to time.

Nothing in this Security Policy limits any obligation imposed on Securus under applicable law.

16. Changes to This Security Policy

We may revise this Security Policy periodically to reflect changes in our technology, security practices, business operations, legal requirements or regulatory guidance. 

Users are encouraged to review this Policy periodically.