Security and Responsible Disclosure

Our approach

• Hosting in India (Mumbai).
• Servers behind a firewall with only web ports open, and automatic blocking of repeated failed sign-in attempts.
• Access by role in the product, with a record of sensitive actions and sign-ins.
• Each customer's data separated inside the system.

We keep improving. Ask us in writing about backups, encryption and uptime for your contract, and we will answer specifically.

Reporting a vulnerability

If you find a security problem, write to support@tulingcreativehub.com with the subject "Security". Please give details we can reproduce. We will acknowledge within 2 working days and keep you informed.

• Please do not access, change or share other people's data, disrupt the service, or publish details before we have had a reasonable time to fix the problem.
• Test only with your own account.
• We will not take legal action against good-faith research that follows these rules and the law.

Out of scope

Social engineering of our staff, physical attacks, denial-of-service tests, and reports of missing best-practice headers with no demonstrated impact. Effective date: 2 November 2026.