POLICY 10 — INFORMATION SECURITY & DIGITAL PROTECTION POLICY

MHS Tools uses reasonable technical and organisational controls designed to protect customer accounts, personal data, software packages, payment workflows and digital entitlements.

Security measures are intended to reduce risk, not to promise that every attack or failure can be prevented.

The website implements secure authentication and session management, server-side authorisation checks, mandatory strong password requirements, secure password-reset procedures, rate limits against automated abuse, least-privilege administrative access, and logging of security and administrative events.

Customers should use unique passwords, protect their devices and report suspected account compromise.

Passwords must not be stored in plaintext or written to application logs.

Password storage and authentication must be handled by a suitable authentication system using accepted security practices.

Where a password policy is configured, it must be consistently enforced on the server, not merely in the interface.

Paid products should be stored in protected storage rather than exposed through predictable public file paths.

The download system should verify user identity and paid entitlement, use protected download access, prevent unauthorized access to other customers' files, record download events, restrict administrative access, and support lawful entitlement revocation.

A hidden button or frontend-only restriction is not sufficient security.

Payment status must be verified server-side using trusted provider confirmation or signed webhooks.

The implementation includes verification of payment amount/currency/order, secure handling of webhook secrets, idempotent processing to prevent duplicate fulfillment, rejection of client-supplied success flags, and denial of paid access for unconfirmed payments.

Where practical, downloadable packages should be scanned for malware before publication. MHS may use package checksums or cryptographic hashes to help verify file integrity.

A malware scan or checksum does not establish that software is entirely safe or free from defects. Customers should maintain their own appropriate backups and security controls.

Administrative functions enforce server-side role checks and restrict access to authorised personnel.

High-impact actions (payment status alterations, package publishing, refund processing, tax editing) are logged with administrator ID, timestamp, action and outcome.

Production customer records must be isolated from demonstration and test records.

If you discover a potential security vulnerability, email info@mechetsolutions.com with a description, affected page/component, steps to reproduce safely, and potential impact.

Do not access, modify, download or disclose another person's data, disrupt the service, or exploit a vulnerability beyond what is reasonably necessary to demonstrate the issue.

If a suspected security incident occurs, MHS will assess, contain, investigate scope and impact, preserve evidence, restore systems securely, notify affected parties and authorities where required by law, and take corrective measures.

Appropriate backups, access restrictions and recovery procedures are maintained for critical business and customer records. Deleted data should not be restored into active use without considering the original deletion request.

MHS does not grant blanket permission to conduct penetration testing or access restricted systems. Testing must be authorised and must respect applicable law and this Policy.