Incident Response Policy

This Policy sets out how Orin Credit Private Limited ("OCPL"), operating the Rupezi digital lending platform as a Lending Service Provider (LSP) to ACG Leasing Limited, detects, contains, reports and recovers from information security incidents and personal data breaches.

It is framed in line with the Information Technology Act, 2000 and the CERT-In Directions of 28 April 2022, the Digital Personal Data Protection Act, 2023 and rules made under it, the Reserve Bank of India (Digital Lending) Directions, 2025, and the terms of our agreement with our lending partner.

This Policy covers all systems, applications, data, employees, contractors and service providers that store, process or transmit information for Rupezi, including customer, borrower, loan and payment data hosted on our cloud infrastructure in India.

An incident is any event that compromises, or could compromise, the confidentiality, integrity or availability of our systems or data. A personal data breach is any unauthorised processing, accidental disclosure, access, alteration, loss or destruction of personal data.

• Incident Response Lead (Head of Technology): owns this Policy, declares incidents, leads containment and recovery, and maintains the incident register.
• Compliance Officer: decides on and makes regulatory notifications, and informs the lending partner.
• Grievance Redressal Officer (Khushi): handles communication with affected customers and related complaints.
• Management / Directors: approve major decisions, external communication, and resources for response.
• All employees and vendors: report any suspected incident immediately and preserve evidence.

1. Detect and report: incidents are identified through monitoring and threat-detection alerts, access logs, vendor notices, customer complaints or staff reports, and logged immediately with the Incident Response Lead.
2. Assess: confirm the incident, assign severity, and identify affected systems, data and customers.
3. Contain: isolate affected systems, revoke or rotate compromised credentials and keys, block malicious traffic, and suspend affected integrations where needed.
4. Preserve evidence: retain logs and system snapshots. System logs are kept for at least 180 days, within India, as required by CERT-In.
5. Eradicate and recover: remove the cause, patch vulnerabilities, restore from clean backups, and verify integrity before returning to normal operation.
6. Notify: make the notifications in Section 6 within the stated timelines.
7. Review: complete a root-cause analysis within 15 days of closure for Critical and High incidents, record corrective actions, and track them to completion.

• CERT-In: reportable cyber security incidents are reported to the Indian Computer Emergency Response Team within 6 hours of being noticed.
• Lending partner (ACG Leasing Limited): informed within 6 hours of detection of any incident affecting borrower data, loan journeys, disbursal or repayment flows, with regular updates until closure and a final incident report.
• Data Protection Board of India and affected customers: personal data breaches are notified as required under the Digital Personal Data Protection Act, 2023 and its rules, within the timelines prescribed there. Customers are told what happened, the likely impact, the steps we have taken and what they can do to protect themselves.
• Law enforcement and other regulators: notified where required by law, or where fraud or criminal activity is involved.

Our service providers are contractually required to notify OCPL of any incident affecting Rupezi data without undue delay, to cooperate in investigation and containment, and to follow equivalent security standards.

• Data is stored and processed only in India, encrypted in transit and at rest, with role-based access control and audit logs.
• Continuous threat detection, web application firewall protection and access monitoring are in place.
• Backups are taken regularly, and restoration is tested periodically.
• Employees receive security awareness training at onboarding and periodically after that.
• This Policy and its procedures are tested at least once a year.

This Policy is reviewed at least once a year, and after any Critical incident or relevant regulatory change, and is approved by the management of Orin Credit Private Limited.