Security Overview
At Multi New Trends, we take the security of our hyperlocal marketplace, user accounts, and personal data seriously. In accordance with India's Digital Personal Data Protection (DPDP) Act, 2023, the Information Technology Act, 2000, and applicable cybersecurity guidelines, we implement reasonable technical and organizational measures designed to protect information from unauthorized access, loss, alteration, or misuse.
This document describes the verifiable safeguards deployed across our web platform and mobile applications, the role of certified third-party service providers, and our procedures for managing security incidents and vulnerability reports.
Account & Authentication Safeguards
User accounts for customers, vendors, and delivery partners are secured through role-specific authentication controls:
One-Time Password (OTP) Verification
Mobile phone number verification utilizes time-limited, cryptographically randomized OTPs delivered via authorized SMS gateways. OTPs expire quickly and are invalidated upon single use.
Session Management
Active sessions utilize short-lived, signed tokens with automatic expiry. Sessions can be terminated remotely, and authentication tokens are invalidated upon password changes or account deletion requests.
Credential Hashing
Where user passwords or secrets exist, they are stored using salted cryptographic one-way hashing algorithms. We never store or transmit plaintext credentials.
Brute-Force & Rate Limiting
Sensitive endpoints—including login, OTP request, and checkout—are protected by automated rate limits to prevent credential-stuffing and automated script abuses.
Secure Data Transmission
All communications between your web browser or mobile application and our backend endpoints are encrypted in transit:
Ecosystem Access & Data Segregation
Multi New Trends operates as a multi-party hyperlocal ecosystem involving Customers, Retail Vendors, and Delivery Partners (Riders). Access control is architected on the principle of least privilege:
Controlled Disclosure
Vendors only receive item details, order IDs, and delivery names required to prepare orders. Riders only receive destination coordinates and masked contact details needed for dispatch.
Merchant Isolation
Each vendor's product inventory, payout history, bank accounts, and customer communications are strictly isolated from other merchant accounts.
Active Order Access
Delivery partners have access to delivery addresses solely during active assignment. Once the order status is completed, address access is revoked.
Payment Security & Partner Roles
RBI-Authorized Payment Aggregators
Multi New Trends integrates with licensed, Reserve Bank of India (RBI) regulated third-party payment aggregators to process digital payments including UPI, Net Banking, Debit/Credit Cards, and Digital Wallets.
Data Storage & Retention Controls
In compliance with the Digital Personal Data Protection Act, 2023, personal data is processed exclusively for specified, lawful purposes and stored within secure database environments:
- Geographic Storage: Primary platform databases and hosting services are hosted in enterprise data centers located within India.
- Purpose Limitation: We do not retain personal information longer than required to fulfill your orders, provide customer support, and meet legal and statutory obligations (such as tax and accounting record-keeping).
- Secure Erasure: When an account is deleted or when the retention period expires, personal data is permanently scrubbed or anonymized in accordance with our Delete Account Policy.
Responsible Vulnerability Disclosure
We welcome collaboration with ethical security researchers, penetration testers, and community members to protect our ecosystem. If you believe you have discovered a potential vulnerability, we ask that you adhere to our responsible disclosure policy:
Disclosure Guidelines:
- Report suspected vulnerabilities promptly to support@multinewtrends.com with the subject "Security Vulnerability Report".
- Include clear, reproducible steps (PoC scripts, screenshots, or HTTP request payloads) without disclosing sensitive personal data.
- Do not access, modify, or destroy user data, vendor records, or disrupt platform availability (e.g. no denial-of-service testing).
- Give our engineering team reasonable time to investigate, remediate, and verify the fix before publishing or sharing details publicly.
Incident Response & Breach Protocols
Multi New Trends maintains incident management procedures to identify, contain, investigate, and remediate cybersecurity events:
CERT-In Reporting
In accordance with directions issued by the Indian Computer Emergency Response Team (CERT-In), cybersecurity incidents of specified categories are documented and reported within mandated statutory timeframes.
DPDP Data Breach Notification
Pursuant to Section 8(6) of the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, in the event of a confirmed personal data breach, Multi New Trends will notify the Data Protection Board of India and affected Data Principals without undue delay.
Security Best Practices for Users & Partners
Security is a shared responsibility. We strongly recommend that customers, vendors, and delivery partners follow these safeguards:
multinewtrends.com) or verified customer care.Security & Grievance Contact
For security inquiries, vulnerability submissions, or personal data security concerns, please reach out through our official channels:
Multi New Trends — Security & Data Protection
* Security reports are acknowledged within 48 business hours. For privacy rights, visit our Privacy Policy or Delete Account Policy.