Security

We focus on protecting:

• customer accounts and authentication
• customer data stored in the platform
• communication between users and Thulo services
• backups and recovery processes
• infrastructure reliability and monitoring

Security is a shared responsibility between Thulo and Customers.

Thulo provides access controls within the platform so Customers can manage roles and permissions.

Customers should:

• assign admin access only to trusted users
• remove access immediately when staff leave
• avoid sharing passwords
• keep contact details updated for security alerts

Thulo stores and processes Customer Data to provide Services. Customer data and system data may be hosted in:

• Nepal (DataHub)
• India (DigitalOcean)
• Backups in Singapore (DigitalOcean)
• Files/media may be stored on DigitalOcean Spaces

We apply reasonable administrative and technical measures to protect stored data from unauthorized access, alteration, or loss.

We use secure communication methods where applicable (e.g., HTTPS/TLS) to reduce the risk of interception when data moves between users and our Services.

We may monitor and log certain system activities to troubleshoot issues, detect suspicious behavior, prevent abuse/spam, and improve stability and security.

Logs may include metadata such as timestamps, IP addresses, device/browser information, and actions taken within the system.

To support recovery and continuity:

• database backups may occur every 2 hours
• daily, weekly, monthly, and yearly backups may also be kept
• backups may be retained for up to 36 months

Backup schedules and retention may change as systems evolve.

We regularly maintain and update our systems. This may include security patches, configuration improvements, dependency updates, and access reviews.

Maintenance may temporarily affect availability.

If we detect a security incident that may impact Customer Data, we may investigate and contain the issue, reset credentials or revoke access where required, and notify affected Customers where appropriate using available contact details.

We may cooperate with lawful requests from authorities as required.

Thulo supports sending emails and SMS for marketing and notifications. Delivery depends on networks and providers.

Customers are responsible for:

• maintaining clean contact lists
• honoring opt-outs/unsubscribes
• avoiding spam-like behavior that can trigger filtering or blocking

• use strong passwords and unique credentials
• enable multi-factor authentication if/when available
• keep devices secure and updated
• restrict admin access
• review user permissions regularly
• watch for phishing attempts
• notify Thulo immediately if suspicious activity is noticed

If you believe you found a security issue or vulnerability, report it to: Email: admin@thulo.com

Please include:

• steps to reproduce (if applicable)
• affected pages/modules
• screenshots/logs (if available)

Do not publicly disclose security issues before giving Thulo a reasonable chance to investigate and fix.

We may update this Security page from time to time. We will update the “Last Updated” date when changes are made.

Thulo (Thulo Digital Solutions Pvt. Ltd.)
Email: admin@thulo.com
Address: 228/55 Jwagal Madhu Marg, Jwagal Tole, Lalitpur, Bagmati, Nepal