ABT Dev Services (Pvt.) Ltd. treats security as part of design, delivery and operation. This page describes the safeguards on our website, client portal and products, how we handle client information during projects, and how to report a vulnerability. Effective date: 27 October 2026.
1. Website and client portal
-
HTTPS everywhere, with security headers including a content security policy, frame protection, content-type protection, a strict referrer policy and restricted browser permissions.
-
Forms are validated on the server and protected by spam checks and request limits.
-
The client portal talks to our CRM only from our server through signed requests; your browser never connects to the CRM directly.
-
Portal accounts are created by invitation, passwords are reset through a link sent to the account email, and the session is held in one http-only, secure cookie that expires within 12 hours.
-
Email is sent through authenticated SMTP with transport encryption.
2. Our products
Qalamora, DishRoute and MandiKhata are built on a shared, security-reviewed platform:
-
Each customer’s data is isolated; tenant checks are enforced on the server and covered by automated tests.
-
Role-based permissions are enforced on every request, not just hidden in the interface; sensitive actions require a reason and are written to an audit log.
-
Two-factor sign-in, encrypted storage of sensitive fields (such as CNIC and medical details), signed links for private files and rate limiting on sign-in.
-
Financial records are append-only: corrections are reversals or adjustments, never silent edits.
-
Daily backups for cloud editions; scheduled encrypted backups and recovery kits for on-premise servers, whose staff connections are encrypted and paired by fingerprint.
3. How we work with client information
-
Access to client systems and data is limited to team members working on the engagement and removed when it ends.
-
Administrative accounts use strong unique passwords and two-factor sign-in.
-
Credentials are exchanged through a password manager or secure channel, never in plain email or chat.
-
During discovery we agree data classification, hosting location, retention and any standards that apply (for example PCI DSS for card data or sector rules for health or education data). We prefer sanitised or sample data for development and testing.
-
Code is kept in private repositories with reviewed changes; dependencies are monitored for known vulnerabilities.
Project-specific commitments, such as penetration testing, compliance support or incident timelines, are set in the signed agreement.
4. Incident response
If we detect or are told about a suspected incident, we contain it, assess its scope, fix the cause and record what happened. Where client or customer data is affected, we notify the client without undue delay, and in any case within 72 hours of confirming the incident, with the information needed to meet their own legal obligations. We cooperate with authorities where the law requires.
5. Reporting a vulnerability
If you believe you have found a security issue in our website, portal or products, email support@abtdevservices.com with the subject “Security report”, the affected URL or product, a description, the potential impact and safe steps to reproduce. Please do not access or change other people’s data, disrupt service, run high-volume automated scans, use social engineering, or publish details before we have fixed the issue. We acknowledge reports within 3 business days, keep you informed, and credit you publicly if you wish. We will not take legal action against good-faith research that follows these rules. We do not currently run a paid bug bounty.