1. Scope & Target Audience
This policy outlines internal data processing and governance standards for the Camsik Admin Suite (mobile application package: in.camsik.admin) and the web administration console.
Access is restricted solely to authorized enterprise staff, system administrators, and vetted operational managers of Camsik Electronics Pvt. Ltd.
2. Operator Telemetry & Audit Logs
To prevent insider threats, unauthorized data manipulation, and ensure complete accountability, the Admin Suite records:
Access Telemetry
Operator login timestamps, origin IP address, device fingerprints, session token lifetimes, and two-factor authentication events.
Operational Mutex Logs
Audit trail of order state changes, valuation overrides, partner commission approvals, customer refund authorizations, and device status modifications.
3. Role-Based Access Control (RBAC)
In compliance with ISO/IEC 27001 and DPDP Act 2023 principles:
- Support Tier: Read-only access to customer contact coordinates and active shipment tracking details. No access to unmasked bank account numbers.
- Finance Tier: Access restricted to payout settlement approvals, GST ledger generation, and banking webhook verification.
- Inventory & Diagnostics Tier: Access to camera and smartphone condition reports, IMEI validation logs, and grading metrics.
- Super Administrator: Full platform configuration with mandatory multi-factor authentication (MFA) and immutable audit log streaming.
4. Handling of Customer & Partner Data
Administrative operators are strictly bound by corporate non-disclosure agreements (NDAs). Exporting bulk customer databases, phone numbers, or private hardware inspection records to unauthorized external drives or personal cloud accounts is strictly prohibited and subject to civil and criminal penalties under Section 43A of the Information Technology Act, 2000.
5. Enterprise Security & Cryptography
All database transactions utilize TLS 1.3 encryption in flight and AES-256 encryption at rest. Internal administrative API endpoints require cryptographically signed JWT session tokens and are protected by rate-limiting algorithms and DDoS mitigation filters.
6. Statutory Retention & DPDP Act Compliance
System audit logs and transaction records are preserved for a statutory duration of 5 years to comply with Indian commercial taxation laws, GST regulations, and cyber security reporting directives issued by CERT-In.
7. Chief Information Security Officer Contact
Enterprise Security & Compliance Office
Camsik Electronics Pvt. Ltd.