Security Assessment Questionnaire (SAQ) - Payment Gateway Security

Merchant Information

Merchant Name: Chhotubhai Chaat Center
Website: https://chhotubhaichatcenter.com
Business Type: Restaurant / Food & Beverage
Location: Ahmedabad, Gujarat, India

Security Declaration

We declare that Chhotubhai Chaat Center does not store, process, or transmit any cardholder data. All payments are securely processed via RBI-approved third-party payment gateways (PayU / Razorpay / Cashfree / PhonePe). Applicable PCI-DSS category: SAQ-A.

1. Website & Hosting Security

✓ Our website and mobile application are hosted on secure servers with industry-standard security measures
✓ SSL/HTTPS encryption is enabled to ensure secure communication between your device and our servers
✓ Firewall protection and regular backups are enabled to protect against unauthorized access and data loss
✓ Regular security updates and patches are applied to maintain the highest level of security

2. Payment Processing

✓ All payments on chhotubhaichatcenter.com and our mobile application are processed securely via RBI-approved third-party payment gateways (PayU, Razorpay, Cashfree, PhonePe)
✓ Our merchant website and application do NOT handle or store any card data directly
✓ All payment transactions are encrypted and processed through secure payment gateway infrastructure
✓ Payment gateway integration follows industry best practices and security standards
✓ Multiple payment options are available for customer convenience, all processed through secure gateways

3. Cardholder Data Storage

✓ We do NOT store sensitive cardholder data such as:
- Card number (Primary Account Number - PAN)
- CVV (Card Verification Value)
- PIN
- Card expiry date
✓ Only basic customer details necessary for order processing and delivery are collected:
- Name
- Email address
- Delivery address
- Phone number
- Order preferences (for food customization)
✓ All customer data is stored securely and used solely for order fulfillment and delivery purposes

4. PCI-DSS Compliance

✓ Our operations are compliant with PCI-DSS (Payment Card Industry Data Security Standard)
✓ Applicable SAQ Type: SAQ-A (Self-Assessment Questionnaire Type A)
✓ SAQ-A applies to merchants who outsource all cardholder data functions to PCI-DSS validated third-party service providers
✓ The responsibility for card data security is entirely handled by our payment gateway providers (PayU, Razorpay, Cashfree, PhonePe)
✓ Our website and application do not directly store, process, or transmit cardholder data

5. Access Control & Security

✓ Administrative access to our systems is strictly restricted to authorized personnel only
✓ We maintain strong password policies and multi-factor authentication where applicable
✓ Regular security audits and assessments are conducted
✓ Security updates are applied promptly to protect our systems
✓ Access logs are maintained and monitored for suspicious activities
✓ Delivery partner access is restricted to order-related information only

6. Legal Pages

✓ A comprehensive Privacy Policy is available on our website
✓ Account Deletion instructions are available for users
✓ Our Terms & Conditions are available for review
✓ Return & Refund Policy is clearly stated
✓ All policies are regularly reviewed and updated to ensure compliance

7. Incident Management

✓ In the event of any security incidents, these are handled collaboratively with our hosting provider and payment gateway support teams
✓ We have established procedures for incident response and resolution
✓ Customers will be notified promptly in case of any security breach affecting their data
✓ Regular communication is maintained with our service providers to ensure prompt resolution

8. Customer Data Protection

✓ We are committed to protecting your personal information
✓ Customer data is used only for order processing, delivery, and customer service purposes
✓ We do not sell or share customer data with third parties except as necessary for order fulfillment and delivery
✓ Data retention policies are in place to ensure data is not kept longer than necessary
✓ Customer food preferences and order history are stored securely for enhanced service experience

9. Payment Gateway Security

✓ All payment transactions are processed through PCI-DSS Level 1 certified payment gateways (PayU, Razorpay, Cashfree, PhonePe)
✓ Payment gateways use industry-standard encryption (SSL/TLS) for all transactions
✓ Payment gateways are compliant with RBI guidelines and regulations
✓ Transaction data is encrypted during transmission and storage
✓ Payment gateways handle all sensitive cardholder data processing
✓ Multiple payment options ensure secure and convenient transactions for our customers

10. Mobile Application Security

✓ Our mobile application follows secure coding practices
✓ Application data is encrypted during transmission
✓ Secure authentication mechanisms are implemented
✓ Regular security updates are pushed to the application
✓ Payment processing within the app is handled entirely by secure payment gateways

11. Contact Information

For any security-related concerns or questions, please contact us:

Email: support@chhotubhaichatcenter.com

Last Updated: January 29, 2026

This security assessment questionnaire is maintained to ensure transparency and compliance with industry security standards. We are committed to maintaining the highest levels of security for our customers' data and payment transactions.