Security

At Chhimphei WPPCL, we implement industry-leading security measures to ensure your data remains protected at all times. Our comprehensive approach to security encompasses multiple layers of protection and continuous monitoring.

Our security practices include:

• Least-privilege access for internal tools
• Regular dependency updates and vulnerability scanning
• Encrypted transport (HTTPS)

We continuously monitor our infrastructure for potential threats and apply security patches promptly to maintain the highest level of protection for your data.

Your financial security is paramount to us. We've designed our payment systems with multiple safeguards to protect your sensitive information throughout every transaction.

Cash-on-delivery by default; any online processing is handled by compliant providers. We don't store full card details.

For online transactions, we partner with PCI-DSS compliant payment processors who specialize in secure payment handling. This means your card information is encrypted and processed through secure channels that meet the highest industry standards.

Our cash-on-delivery option provides an additional layer of security for customers who prefer not to share payment information online, giving you complete control over how and when you make your payment.

We take security vulnerabilities seriously and appreciate the efforts of security researchers and ethical hackers who help us maintain a secure platform. If you discover a potential security issue, we encourage you to report it responsibly.

When reporting a vulnerability, please include:

• A detailed description of the vulnerability
• Steps to reproduce the issue
• Potential impact of the vulnerability
• Any proof-of-concept code (if applicable)
• Your contact information for follow-up

We commit to acknowledging your report within 48 hours and will work diligently to address valid security concerns. We ask that you give us reasonable time to investigate and resolve the issue before public disclosure.

Please refrain from accessing or modifying user data, executing denial-of-service attacks, or engaging in any activity that could harm our users or services during your security research.