Website Access & Security Policy

At Neel Networks, we believe that clients should have appropriate access to their websites and digital systems, along with a clear understanding of how that access is managed.

Website administration often involves several parties, including our technical team, the client and, in some cases, other authorised service providers.

To maintain security and ensure smooth ongoing operations, it is important that access permissions, responsibilities and support arrangements are clearly understood.

This policy explains how website access and credentials are managed, what responsibilities apply when changes are made and how Neel Networks can assist when technical issues arise.

Our objective is to support a secure, transparent and cooperative working relationship.

Access credentials means any login to the systems a website depends upon. Several distinct kinds exist, and they carry different levels of risk, which is why they are often granted separately rather than all together.

Website administrator access

The login to your content management system, such as WordPress Admin, a Shopify dashboard, a WooCommerce back end or a custom dashboard. This is what allows pages, products, images and text to be edited. Most content work needs nothing more than this, and within it a role such as Editor or Author is often sufficient.

Hosting control panel access

The login to cPanel, Plesk, DirectAdmin, hPanel or an equivalent. This governs the server environment: PHP version, mailboxes, disk usage, SSL and backups. A change made here affects the whole account rather than a single page.

Domain and DNS management

The registrar account and the DNS zone, including nameservers and MX records. These determine where your domain points and where your email is delivered. A single incorrect record can take a website offline or stop email arriving, which is why changes here are usually co-ordinated rather than made in isolation.

Database and server credentials

Direct access to the database through phpMyAdmin or a similar tool, and file-level access through FTP, SFTP or SSH. These bypass the safeguards built into the application itself, and are normally needed only for development work.

Third-party platform access

Accounts held with other providers that your website connects to, such as payment gateway dashboards, CRM connections, API keys, analytics accounts and cloud consoles. These are usually owned by you directly, with our team added as a user where the work requires it.

Why access levels differ

Different levels exist because different work needs different reach. Granting only what a task requires reduces the chance of an accidental change, limits the damage if a password is ever exposed, and makes it much easier to establish what happened if something goes wrong. It is a practical measure rather than a restriction, and we are glad to discuss the right level for your team.

We understand that clients may need access to manage their website content, review information, make updates or work with their internal teams. Where appropriate, Neel Networks can provide the relevant access details in accordance with the agreed service arrangement and applicable security procedures.

Requesting access

Please write to support@neelnetworks.com telling us what you would like to be able to do, and who in your team needs to do it. That is usually enough for us to suggest the right level. Requests are confirmed with the client contact on record before anything is issued, which protects your website against a request that did not in fact come from you.

How credentials are handed over

• Credentials are shared through a secure method rather than plain email or messaging, and we are glad to use your own password manager where you have one.
• Wherever the platform allows, we create a named account for each person rather than sharing a single login, so that activity can be attributed.
• We would be grateful if you could change the password immediately on receiving it, and not retain the one we issue as a permanent password.
• We confirm in writing what has been issued, to whom and at what level, so that both sides hold the same record.

Conditions applying to privileged access

Hosting, server, database and registrar credentials carry more risk than content access, and a few conditions apply to them.

• Full project files and credentials are released on completion and full payment, as described in our Terms & Conditions. We do not withhold access from a settled account.
• We would ask to be told before privileged access is passed on to anyone else, so that we are able to advise and keep our own records accurate.
• Where we continue to manage a website after handing over privileged access, we may ask that significant server or database changes be co-ordinated with us. This is to protect the website rather than to control it.
• Where a credential appears to have been exposed, we may reset it and inform you immediately afterwards, as acting quickly is the priority in that situation.

Providing access does not alter what we have already agreed to provide. It does mean that more than one party is able to change the website, which is why section 3 sets out how responsibility for a particular issue is determined.

When changes are made to a website, it is important to understand who carried out those changes and whether they fall within the agreed maintenance or support arrangement.

Neel Networks remains responsible for the services and obligations it has agreed to provide. However, issues resulting from changes independently made by a client or an authorised third party may require separate technical assistance, depending on the circumstances and the applicable service agreement.

Where additional work is required, we will aim to explain the issue, the recommended solution and any applicable charges before proceeding.

How the position is determined

Providing website or hosting access does not automatically change the responsibilities already agreed between Neel Networks and the client. Responsibility for a particular issue will depend on the applicable service agreement, the nature of the changes made and the circumstances that caused the issue.

Where an issue arises from changes independently made by the client or an authorised third party, additional technical assistance may be required. If the work falls outside the agreed support arrangement, we will explain the recommended solution and any applicable charges before proceeding.

In practice we look at three things.

• What caused it. A fault in code we wrote, or in an update we applied, is ours to correct. A fault arising from a change made independently of us is a different matter.
• What your agreement covers. The included support period following a project, and the scope of any maintenance plan, determine what is covered without further charge.
• What the record shows. Where the cause is not immediately apparent, establishing it is part of the work, and we will say so rather than assume.

Where the cause is ours

Where an issue arises from our own code, our own configuration or an update we applied, and the website is within an applicable support period or an active maintenance plan, we correct it under that arrangement at no additional charge. Who else holds credentials does not alter that position. Outside an applicable support period or active plan, we will of course still assist, and the work is quoted in the ordinary way.

Where the cause lies elsewhere

Where an issue arises from a change made by you, by your team, or by a third party you have authorised, and that work falls outside the agreed support arrangement, investigation and repair are quoted as additional work. The same applies to a security incident arising from exposed or weak credentials, from software installed independently of us, or from a hosting environment we do not manage.

This is not a withdrawal of support. We will assist in every case, and promptly. It means only that in these circumstances the work is quoted rather than absorbed, and that you will know the cost before we begin.

Where the cause is genuinely unclear

Sometimes the cause cannot be established without investigation. Where that is so, we will tell you what diagnostic work is needed and what it will cost before we begin. Where the investigation establishes that the cause falls within an applicable support period or active maintenance plan, the diagnostic work is treated as part of that arrangement and is not charged separately.

You are entirely free to engage another agency, a freelancer or an in-house developer, and we will co-operate with them willingly. Many of our clients work this way, and it causes no difficulty when it is handled openly.

Before granting access

We would be grateful if you could tell us before giving a third party back-end access. Our reasons are practical rather than proprietary: we can advise on which role and permissions to grant so that risk is kept low, make sure a backup exists first, and keep our records of who holds what accurate. A short email is all that is needed, and we do not require your approval to be sought from us.

Access, permissions and co-ordination

• Wherever the platform allows, we would suggest a named account for the third party rather than sharing an existing login, so that their work is distinguishable from everyone else's.
• Where both teams are working on the same website, co-ordinating through a shared staging environment and agreeing who changes what avoids most of the problems that otherwise arise.
• We are glad to speak directly with your chosen developer where that would help.

Responsibility for independently performed work

We are not able to accept responsibility for broken functionality, data loss, design changes, performance problems or vulnerabilities introduced by a developer working independently of us, and the fact that we originally built the website does not alter that. Equally, we do not treat the involvement of another developer as ending our own obligations: anything caused by our own work remains ours to correct.

Where a third party has worked on an area covered by your maintenance plan, we may need to review that area before continuing to cover it, so that we are not underwriting changes we have not seen. Where a review is needed, we will tell you what it involves and what it costs. If their work needs to be corrected, we will assess the website and quote for the remediation.

If you need work that falls outside our current scope, you are most welcome to ask us first. We may well be able to carry it out ourselves.

The measures below are recommendations rather than contractual obligations, except where a particular one is written into your service agreement. We set them out because they genuinely reduce risk, and because a website that follows them is far less likely to need the kind of recovery work described in section 6.

What we would recommend

• Strong, unique passwords for each access point, not reused across services.
• Multi-factor authentication wherever the platform supports it, including CMS, hosting, registrar and email. This is the single most effective measure available.
• Restricted administrator access. Full administrator rights for those who genuinely need them, and a restricted role such as Editor or Author for everyone else.
• Secure credential sharing through a password manager rather than SMS, plain email or a messaging application, and prompt revocation when someone no longer needs access.
• Software updates applied promptly, and tested on a staging copy first where the website is of any complexity. We would particularly ask that the PHP version not be changed through a hosting panel without first confirming compatibility with your CMS, theme and every active plugin, as a mismatch is among the most common causes of a completely broken website.
• Backup arrangements. A complete backup of files and database before any significant change, and an independent copy kept somewhere separate, whoever manages your hosting.
• Prompt reporting. If you suspect a compromise, unusual activity, an unexpected administrator account or unfamiliar file changes, please tell us at once. A problem reported early is almost always cheaper and quicker to resolve than one reported late.

What falls outside our responsibility

We are not able to accept responsibility for a security incident arising from weak or reused passwords, from credentials shared with people who should not have them, from multi-factor authentication left switched off where it was available, from software installed independently of us that carries a known vulnerability, from credentials compromised on your own devices or email accounts, from server-level vulnerabilities on hosting we do not manage, or from a delay in applying a security update after we have drawn your attention to it.

We may also suggest security plugins, a firewall or content delivery network, malware scanning or server hardening. Any third-party fees for these are payable by you, and we will tell you the cost before anything is incurred.

If you suspect that your website has been compromised, please contact us immediately at support@neelnetworks.com or on +91 91366 94505. We treat a suspected compromise as our highest priority.

If a technical issue arises, our team can assist in reviewing the problem and identifying an appropriate solution. The support provided, applicable response arrangements and any additional charges will depend on the cause of the issue and the services covered by the client's agreement.

Reporting an issue

Please write to support@neelnetworks.com with the website address, a description of what you are seeing, and any screenshots, page links or error messages. If you know of a recent change, such as a plugin installed or a setting altered, telling us saves a good deal of diagnostic time. A website that is completely unavailable, a broken checkout or a suspected security breach is treated as our highest priority.

How we respond

1. We acknowledge the request and assess the urgency.
2. We review the problem and work out what caused it.
3. We tell you what we have found, what we recommend, whether it falls within your existing cover, and what any additional work would cost.
4. We proceed once you have confirmed, and we do not carry out chargeable work without your written approval.

Recovery and restoration

Where a restore is needed, we are glad to carry one out. Where we manage your hosting, scheduled backups form part of that service and a restore following a server-side failure is included. A restore needed because of a change made independently of us is chargeable work, as is recovery from a compromise originating outside the code and configuration we are responsible for. Where you manage your own hosting, backups are your responsibility unless we have agreed otherwise in writing, and we are not able to accept liability for data loss arising from backups that were missing, failed or corrupted in an environment we do not control.

Chargeable support

Work requested outside the scope of an active maintenance plan or an included support period is chargeable at our standard hourly rate, or against an approved scope. We will always quote before starting, and you will never receive an unexpected invoice from us. Third-party costs, such as licences, premium plugins or additional infrastructure, are payable by you following your approval.

Access and maintenance are separate matters

It is worth being explicit about this, because the two are often assumed to go together. Holding administrator credentials is not a maintenance subscription, and a maintenance subscription is not defined by who holds the credentials. They are independent of one another.

• Having access does not entitle you to maintenance work, and it does not oblige you to carry out that work yourself.
• Not having access does not mean your website is being maintained. Maintenance exists only where you hold a plan or are within an included support period.
• Holding a maintenance plan does not require you to give up your own access.

How the two interact in practice

Where we hold the technical access and you hold a maintenance plan, we are able to work on a tested schedule, apply updates in a controlled way and monitor what we are responsible for. This is the arrangement under which we can offer the clearest commitments, and it is how our plans are designed to work.

Where you also hold access, the plan continues to apply. What changes is that a change made independently of us may need to be reviewed before we continue to cover the area it affected, as described in sections 3 and 4. That is a review rather than a cancellation, and we will tell you what it involves.

What a plan covers

The particular services, allowances and response arrangements that apply to your website are set out in our Website Maintenance & Support Terms and in your own maintenance proposal. Hosting is a further distinct matter again, governed by our Domain & Hosting Terms: hosting keeps the server running, while maintenance looks after the website on it.

Requesting an access change or a handover

To request credentials, a change to an access level, the addition or removal of a user, or a full handover of everything we hold for you, please write to support@neelnetworks.com. We will confirm the request with the client contact on record and then act on it. A full handover on a settled account is provided on request and is not withheld.

Changes to this policy

We may update this policy from time to time, and the current version is always published here. Material changes are communicated to active clients at least 14 days before they take effect.

Liability

Subject to the paragraph below, we are not liable for loss, damage, data corruption, business interruption, loss of revenue, reputational harm or other loss arising from changes made to the website independently of us, from security breaches resulting from exposed credentials or access granted by you, from downtime or data loss caused by such changes, from updates applied without our oversight, from automatic updates enabled without our knowledge, or from failures of third-party services, platforms, hosting providers or APIs.

Where we are found liable for something arising from our own work, our total liability is limited to the amount paid for the particular service or project in the 6 months before the claim.

Nothing in this policy excludes or limits any liability that cannot lawfully be excluded or limited, including liability for death or personal injury caused by negligence, liability for fraud, and any right or remedy available to you under applicable consumer protection law.

Governing law, jurisdiction and disputes

This policy is governed by the laws of India. The courts of Mumbai, Maharashtra have exclusive jurisdiction over any dispute relating to it, to the handover of credentials, or to client-managed access. Both parties agree to attempt a resolution through good-faith discussion before beginning formal proceedings.

How to reach us

Access, security and technical support	support@neelnetworks.com
Telephone	+91 91366 94505
Office	A-104, Bhoomi Utsav, M. G. Road, Kandivali West, Mumbai 400067, Maharashtra, India
Business hours	Monday to Friday, 10:00 am to 7:00 pm IST

If anything here is unclear, you are most welcome to write to us. We would far rather answer a question now than resolve a misunderstanding later.