Certainly. For SecureGate – SASE Client, I recommend having a dedicated Security Policy separate from the Privacy Policy and Terms & Conditions. The Security Policy should explain how Ai-Technology protects the SecureGate platform, user accounts, network traffic, infrastructure, and security operations.

Below is a professional version suitable for publishing on your website and linking from the SecureGate application.

SecureGate Security Policy

Product: SecureGate – Secure Access Service Edge (SASE) Client
Organization: Ai-Technology
Effective Date: 13 Auh 2026

1. Purpose

Ai-Technology is committed to maintaining the security, confidentiality, integrity, and availability of SecureGate, its users, and the infrastructure supporting the SecureGate service.

SecureGate is designed using modern Secure Access Service Edge (SASE) and Zero Trust security principles to provide secure connectivity, policy-based access, network protection, and security services for individual users, professionals, and organizations.

This Security Policy describes the security principles and practices that Ai-Technology applies to SecureGate and its supporting infrastructure.

2. Security Principles

SecureGate follows the following core security principles:

Confidentiality

Protect information and network communications against unauthorized access or disclosure.

Integrity

Protect systems, configurations, security policies, and information from unauthorized modification.

Availability

Maintain reliable access to SecureGate services while protecting infrastructure against disruption and abuse.

Least Privilege

Provide users, administrators, services, and systems only the permissions required to perform their authorized functions.

Zero Trust

SecureGate follows a Zero Trust security approach based on the principle:

Never trust by default. Always verify.

Access decisions may consider factors such as:

User identity
Authentication status
Device information
Security posture
Network context
Requested resource
Applicable security policies

3. SecureGate Architecture

SecureGate uses a cloud-oriented SASE architecture designed to integrate networking and security capabilities.

Depending on the service configuration, SecureGate may include:

Secure VPN connectivity
Zero Trust Network Access
Secure Web Gateway
DNS security
Threat protection
Web filtering
Network security policies
Access control
Security monitoring
Security analytics
Traffic protection
Cloud security services

Security controls may be distributed across SecureGate's infrastructure to provide consistent protection regardless of the user's network location.

4. Encryption

Ai-Technology uses encryption and secure communication protocols to protect information transmitted between SecureGate components.

Data in Transit

Network communications between the SecureGate application and applicable SecureGate infrastructure are protected using appropriate secure protocols and encryption mechanisms.

VPN traffic is protected through the configured VPN/SASE tunnel.

Data at Rest

Where sensitive information is stored, Ai-Technology applies appropriate technical safeguards designed to protect stored information against unauthorized access.

The specific encryption technologies may vary depending on the infrastructure and service component involved.

5. VPN Security

SecureGate uses Android's VPN functionality (VpnService) to establish a secure network tunnel.

The VPN capability may be used to:

Protect network traffic
Apply security policies
Route traffic through SecureGate security infrastructure
Provide secure access to authorized resources
Apply threat-protection controls
Provide SASE security functionality

SecureGate does not intentionally use VPN functionality to manipulate network traffic for advertising monetization.

6. Authentication and Access Control

SecureGate applies appropriate authentication and access-control mechanisms.

Depending on the deployment, authentication may include:

Username and password
Multi-factor authentication
Token-based authentication
Device authentication
Session-based authentication
Organization-managed identity providers

Administrative access is restricted to authorized personnel.

Access privileges are assigned according to job responsibilities and the principle of least privilege.

7. Administrative Security

Access to SecureGate administrative systems is restricted to authorized Ai-Technology personnel.

Administrative security controls may include:

Strong authentication
Multi-factor authentication
Role-based access control
Least-privilege access
Administrative logging
Session controls
Access reviews
Secure administrative channels

Privileged access is granted only when required for legitimate operational or security purposes.

8. Infrastructure Security

SecureGate infrastructure is protected using multiple layers of security controls.

These may include:

Network segmentation
Firewalls
Access controls
Security monitoring
Intrusion detection and prevention
DDoS protection
Secure configuration management
Vulnerability management
System hardening
Patch management

Infrastructure configurations are reviewed periodically to identify and reduce unnecessary exposure.

9. Application Security

Ai-Technology applies secure development practices when developing and maintaining SecureGate.

Security practices may include:

Secure coding practices
Code review
Dependency management
Vulnerability scanning
Security testing
Authentication testing
API security testing
Input validation
Secure session management
Access-control testing

Third-party software dependencies may be reviewed and updated to address known security vulnerabilities.

10. Vulnerability Management

Ai-Technology maintains processes for identifying, evaluating, prioritizing, and remediating vulnerabilities affecting SecureGate.

Vulnerabilities may be identified through:

Automated vulnerability scanning
Dependency scanning
Security testing
Code analysis
Security research
Vendor advisories
Threat intelligence
Responsible vulnerability reports

Security vulnerabilities are prioritized according to factors such as:

Severity
Exploitability
Exposure
Potential impact
Availability of mitigation
Threat activity

Critical vulnerabilities may receive accelerated remediation.

11. Security Monitoring

Ai-Technology may monitor SecureGate infrastructure for indicators of:

Unauthorized access
Account compromise
Malicious activity
Infrastructure attacks
Service abuse
Unusual traffic patterns
Authentication anomalies
Security policy violations

Security monitoring is intended to protect the SecureGate service and its users.

Monitoring activities are conducted in accordance with the SecureGate Privacy Policy and applicable law.

12. Logging and Audit Information

Security-related logs may be generated to support:

Security monitoring
Troubleshooting
Fraud prevention
Abuse prevention
Incident investigation
System reliability
Compliance requirements

Ai-Technology follows data-minimization principles and does not retain information beyond what is reasonably required for legitimate operational, security, legal, or compliance purposes.

SecureGate's specific logging and retention practices are described in the Privacy Policy.

13. Network Traffic Protection

SecureGate is designed to provide protection for network traffic routed through its infrastructure.

Depending on the configured service, security controls may include:

Malicious-domain blocking
DNS security
Web filtering
Threat detection
Malware protection
Access-control policies
Security policy enforcement
Network anomaly detection

Security inspection may be performed where required by the selected SecureGate service.

14. DDoS and Infrastructure Protection

Ai-Technology may implement appropriate controls to protect SecureGate infrastructure from denial-of-service and other availability attacks.

These controls may include:

Rate limiting
Traffic filtering
Network-level controls
DDoS mitigation
Automated abuse detection
Infrastructure scaling
Traffic monitoring

Users must not use SecureGate infrastructure to launch or facilitate attacks against other systems.

15. Endpoint Security

SecureGate's security depends partly on the security of the user's device.

Users are strongly encouraged to:

Keep Android updated.
Install security updates promptly.
Use device screen locks.
Enable appropriate device authentication.
Avoid installing applications from untrusted sources.
Keep SecureGate updated.
Avoid sharing account credentials.
Report suspected compromise.

SecureGate cannot protect a device against every threat, particularly where the device itself has already been compromised.

16. Data Protection

Ai-Technology applies data-minimization principles when designing SecureGate.

Information collected or processed by SecureGate is intended to be limited to what is reasonably necessary for:

Providing the Service
Authentication
Security
Network connectivity
Troubleshooting
Service improvement
Fraud prevention
Abuse prevention
Legal and regulatory obligations

Detailed information regarding data collection, use, retention, and sharing is provided in the SecureGate Privacy Policy.

17. Third-Party Security

Where third-party services are used to support SecureGate, Ai-Technology seeks to use providers that maintain appropriate security practices.

Third-party services may include:

Cloud infrastructure
Payment providers
Authentication providers
Security providers
DNS providers
Monitoring platforms
Crash-reporting services

The security practices of third-party providers may be governed by their respective security and privacy policies.

18. Security Incident Response

Ai-Technology maintains procedures for responding to suspected security incidents.

Incident response may include:

Detection
Initial assessment
Containment
Investigation
Eradication
Recovery
Root-cause analysis
Remediation
Post-incident review

Where required by applicable law, Ai-Technology will notify affected users or relevant authorities regarding qualifying security incidents.

19. Responsible Disclosure

Ai-Technology encourages security researchers and users to responsibly report suspected vulnerabilities in SecureGate.

Security reports should include sufficient information to reproduce and understand the issue.

Reports may include:

Description of the vulnerability
Affected component
Reproduction steps
Potential impact
Supporting evidence
Suggested mitigation, if available

Security Contact

Email: [security@yourdomain.com]

Please do not publicly disclose a vulnerability before Ai-Technology has had a reasonable opportunity to investigate and address it.

20. Security Updates

Ai-Technology may release security updates to address:

Vulnerabilities
Security weaknesses
Compatibility issues
Infrastructure changes
Emerging threats

Users are encouraged to install SecureGate updates promptly.

Using an outdated version may increase security and compatibility risks.

21. Business Continuity and Availability

Ai-Technology may maintain operational procedures designed to support the availability and recovery of SecureGate services.

Depending on the infrastructure, these may include:

Infrastructure redundancy
Backup procedures
Monitoring
Disaster recovery procedures
Failover mechanisms
Capacity management
Incident response procedures

Specific recovery objectives may vary depending on the service architecture and infrastructure.

22. Employee and Administrator Security

Personnel with access to SecureGate systems are expected to follow applicable security requirements.

Security measures may include:

Access authorization
Confidentiality requirements
Security awareness
Strong authentication
Least-privilege access
Administrative monitoring
Periodic access reviews

Access is removed or modified when personnel responsibilities change or access is no longer required.

23. Security Policy Compliance

Ai-Technology aims to align SecureGate security practices with recognized cybersecurity principles and industry best practices.

Depending on the applicable environment, these may include principles derived from:

Zero Trust Architecture
Secure Access Service Edge (SASE)
NIST Cybersecurity Framework
NIST Zero Trust Architecture
OWASP security practices
Secure software development principles
Applicable data-protection requirements

References to these frameworks do not necessarily constitute certification or formal compliance unless expressly stated by Ai-Technology.

24. User Security Responsibilities

Users are responsible for maintaining the security of their own accounts and devices.

Users must:

Protect their credentials.
Use strong authentication.
Keep their device updated.
Avoid sharing accounts.
Report suspicious activity.
Follow applicable laws.
Follow SecureGate's Terms & Conditions.
Use the Service responsibly.

25. Security Limitations

Although Ai-Technology implements reasonable security measures, no system can guarantee absolute security.

SecureGate cannot guarantee protection against every:

Malware infection
Zero-day vulnerability
Account compromise
Phishing attack
Social-engineering attack
Device compromise
Third-party security incident
Infrastructure failure
Internet outage
Advanced persistent threat

Security is a shared responsibility between Ai-Technology, users, infrastructure providers, and other relevant parties.

26. Policy Updates

Ai-Technology may periodically update this Security Policy to reflect:

Changes to SecureGate architecture
New security technologies
Changes in applicable regulations
New security threats
Changes to operational practices
Improvements to security controls

The Last Updated date will be revised whenever this policy is materially updated.