Security

Security is part of doing the boring work properly. Our products hold people's rent records, tax details, and identity documents, so protecting them isn't a feature — it's the job.

We're a young lab, and we'd always rather hear about a problem than pretend we don't have one. If you've found a weakness, tell us. We'll act on it, keep you in the loop, and say thank you.

Found a security issue in a Cedr product or website? Email security@cedrailabs.in.

Please include what you found, the steps to reproduce it, the URL or product affected, and — if you can — what an attacker could do with it. A screenshot or short recording helps. We aim to acknowledge your report within 3 working days and to keep you posted as we investigate and ship a fix.

Please give us a reasonable window to fix the issue before sharing it publicly. We'll work the problem quickly and tell you when it's safe to talk about.

In scope: cedrailabs.in, rentcare.app, and the APIs behind them.

Out of scope, for now: third-party services we rely on (please report those to the vendor directly), automated scanner output without a working proof-of-concept, denial-of-service testing, social engineering of our team or our users, and anything that needs access to another person's account or data. As we ship more products, we'll widen this list.

If you act in good faith — you don't access, change, or delete data that isn't yours, you don't degrade the service for others, and you give us a fair chance to fix the issue before going public — we will not pursue legal action against you for your research. We'll treat your report as a contribution, not a threat.

Security reports: security@cedrailabs.in.

For privacy or data-protection concerns specifically, our Data Protection Officer is at dpo@cedrailabs.in. For anything else, write to grievance@cedrailabs.in — we respond within 7 working days as required under the DPDP Act, 2023.