Skip to content
Metrosales

Legal

Security Policy

How we keep the MetroSales platform and your data safe.

Security Policyupdated May 2026
Our approach
Infrastructure
Application security
Encryption
Integrations
Plain language · your rights spelled out

01Our approach

At MetroGuild Inc., every architectural decision starts with security. This policy explains how we protect the MetroSales.AI platform and the data our customers trust us with.

02Infrastructure

MetroSales.AI is hosted on Amazon Web Services (AWS) across multiple regions and availability zones for resilience.

03Application security

  • Layered protection including AWS Shield and a web application firewall (WAF).
  • Multi-factor authentication and role-based access control.
  • Data isolation for every customer.
  • Rate-limited, scoped API tokens.

04Encryption

  • At rest: AES-256, with keys managed in AWS Key Management Service (KMS).
  • In transit: TLS 1.2 or higher, with automatic redirects from HTTP to HTTPS.

05Integrations

  • Meta: OAuth 2.0 and verified webhook signatures.
  • Portal credentials: stored in AWS Secrets Manager.
  • Telephony: encrypted SIP signalling and SRTP media.

06Access control

Only authorised DevOps staff can access production, using multi-factor authentication over a VPN. Developers have no access to production customer data, and all access is reviewed every quarter.

07Physical security

Our Pune development centre has 24×7 security, biometric entry, CCTV and UPS power backup. Telephony infrastructure runs in secured facilities.

08Secure development

  • Peer review of every change.
  • Automated vulnerability and dependency scanning.
  • Periodic penetration tests by independent third parties.
  • Critical vulnerabilities patched within 48 hours.

09Compliance

  • HIPAA eligible — a Business Associate Agreement (BAA) is required before any protected health information is processed.
  • GDPR.
  • India's IT Act 2000 and Digital Personal Data Protection Act 2023.
  • TRAI DLT regulations for SMS.
  • WhatsApp Business Policy.

10Incident response

We follow a documented incident response plan and notify affected customers within 72 hours of discovering an incident.

11Reporting a vulnerability

Please report security issues to secure.ml@metroleads.com. We acknowledge reports within 48 hours and send a resolution update within 10 business days. Please do not disclose a vulnerability publicly until it has been resolved.

12Contact

Questions about this policy: sales@metroguild.com

This page is provided for general information and should be reviewed by your legal adviser.