XC
0MRADE
xc0mrade@root
Loading0%
“Built in India, for India. We never sell your data. We collect only what we need.”
Xc0mrade Technologies Private Limited (CIN: U62099BR2025PTC079540), registered in Bihar, India, operates the vulnerability marketplace platform accessible at https://xc0mrade.com(the “Platform”). We connect Security Researchers with Organizations to find and fix security vulnerabilities through structured programs.
We process your data responsibly under the Digital Personal Data Protection Act (DPDP), 2023, the Information Technology Act, 2000, and applicable RBI and CERT-In guidelines.
When you create an account we collect your name or display handle, email address, password (hashed), and your chosen role (Security Researcher or Organization).
WHY: To create and manage your account, authenticate your identity, and provide role-appropriate access.
Researchers provide bio, skills, and avatar. Organizations provide company name, website, and industry.
WHY: To personalize your experience, match researchers with programs, and display the leaderboard.
Security Researchers wishing to receive Rewards must complete KYC verification (Aadhaar, Passport, or Voter ID, PAN card).
WHY: Mandatory under the PMLA 2002 and RBI guidelines. We use Razorpay to process data.
We collect report titles, targets, severity, reproduction steps, and Sketches created using the Sketcher tool.
WHY: To facilitate disclosure. Accepted reports are transferred to the relevant Customer organization.
Under DPDP Act 2023, we use:
We share personal data only where necessary for service delivery, legal compliance, or security operations.
Razorpay: payment processing, payout workflows, and KYC facilitation.
Supabase: database, authentication, and secure storage infrastructure.
Vercel: hosting, edge delivery, and application runtime services.
Each processor operates under contractual data processing obligations covering purpose limitation, security safeguards, breach notification, and data return/deletion obligations at termination.
| Type | Period | Legal Basis |
|---|---|---|
| KYC Documents | 5 years min | PMLA 2002 |
| Financial Records | 7 years | Income Tax 1961 |
| IT Logs | 180 days | CERT-In 2022 |
| Accepted Reports | 5 years | Contractual |
Summary of held personal data.
Correction of inaccurate data.
Deletion subject to Section 6.
Timely redressal (see Section 9).
Nominate another in case of death.
Withdraw consent anytime.
We design our infrastructure to prioritize Indian data residency for Indian users. Where third-party processors are used, Xc0mrade enforces contractual localization and protection requirements.
Cross-border transfers, if any, are carried out only in accordance with applicable DPDP requirements and to jurisdictions permitted by the Central Government.
Appointed Officer
Vivek Singh — Founder
grievance@xc0mrade.com
Timeframe
Ack: 24h | Resolve: 7d
In the event of a personal data breach affecting your data, Xc0mrade will notify affected Data Principals and the Data Protection Board of India within 72 hours of becoming aware of the breach, in accordance with applicable DPDP Rules.
Notifications include, where reasonably available at the time of reporting: (i) the nature of the breach, (ii) likely consequences, and (iii) mitigation/remedial measures taken.
We use essential cookies for authentication and session security, along with limited analytics/operational telemetry to improve platform reliability and performance.
You can manage browser cookie controls. Disabling essential cookies may prevent login or core platform usage.
Certain researcher ranking outcomes are algorithmically calculated (for example, Sketch Score and P-Tier progression inputs). See GCU section 13 and Schedule A for scoring criteria.
High-stakes tier decisions (including key promotions/demotions) are subject to human review.