Vendor Security Questionnaire

Question

Is the vendor ISO 27001 certified?

FretBox Response

Yes — ISO 27001:2022 certified (December 2024). Certificate available on request.

Question

Is the platform compliant with India's Digital Personal Data Protection Act (DPDPA) 2023?

FretBox Response

Yes. FretBox is fully DPDPA 2023 compliant with documented data processing agreements.

Question

Where is data hosted?

FretBox Response

All data is hosted in Indian data centres (Mumbai region). On-premise deployment is also available.

Question

Is the vendor NAAC / NBA / NIRF reporting-ready?

FretBox Response

Yes. FretBox auto-generates NAAC Criteria II, V, VI reports and NIRF dataset exports.

Question

What encryption standard is used for data at rest?

FretBox Response

AES-256 encryption for all data at rest.

Question

What encryption is used for data in transit?

FretBox Response

TLS 1.3 for all data in transit over HTTPS.

Question

Are database backups encrypted?

FretBox Response

Yes. All backups are encrypted with the same AES-256 standard.

Question

How frequently are backups taken?

FretBox Response

Daily automated backups with 30-day retention. Point-in-time recovery available.

Question

Is multi-factor authentication (MFA) supported?

FretBox Response

Yes. MFA is mandatory for all administrator accounts and optional for staff accounts.

Question

What is the access control model?

FretBox Response

Role-Based Access Control (RBAC) with granular per-module permission management.

Question

Is there session timeout functionality?

FretBox Response

Yes. Configurable session timeout; defaults to 8 hours for staff, 1 hour for admin.

Question

Is Single Sign-On (SSO) supported?

FretBox Response

Yes. SAML 2.0 and LDAP/Active Directory integration available.

Question

What is the uptime SLA?

FretBox Response

99.9% uptime SLA with financial penalties for breach. Historical uptime: 99.97%.

Question

Is DDoS protection in place?

FretBox Response

Yes. Layer 3/4/7 DDoS protection via cloud-native WAF and CDN layer.

Question

How frequently are security audits / penetration tests conducted?

FretBox Response

Annual third-party penetration testing plus quarterly internal security assessments.

Question

Is there a vulnerability disclosure / responsible disclosure programme?

FretBox Response

Yes. Contact security@fretbox.in. CVEs are patched within SLAs defined by severity.

Question

Who owns the data?

FretBox Response

The institution retains full data ownership at all times.

Question

Can data be exported?

FretBox Response

Yes. Full data export in CSV/JSON/XLSX at any time via the admin console.

Question

What happens to data on contract termination?

FretBox Response

All data is returned to the institution and securely deleted within 30 days.

Question

Are parent/student consent mechanisms in place?

FretBox Response

Yes. Configurable consent workflows aligned with DPDPA requirements.

Question

Are audit logs immutable?

FretBox Response

Yes. Audit logs are append-only and cannot be modified by any user including admins.

Question

How long are logs retained?

FretBox Response

Minimum 12 months; configurable up to 7 years for regulatory requirements.

Question

Is real-time anomaly detection in place?

FretBox Response

Yes. ML-based anomaly detection alerts the institution's IT team within minutes.

Question

Can institutions generate compliance reports?

FretBox Response

Yes. One-click compliance reports for internal audits, NAAC, and regulatory submissions.