Business ProfileforAnand Systems Inc

This business seems to be *** based (********** address, ******** incorporation) but with a significant overseas tech team, likely the vast majority of their actual implementation of their product is done overseas.This is only relevant because when managing any team, but especially an overseas software team when processing *** of US persons, it is often the case with a small company such as this to not really be aware of implementation specifics and also possibly not processing said *** in accordance with US regs or consumer expectations.They seem to have a foothold in a handful of boutique hotels, one of which I recently transacted with using a card I only used for this purpose, using other cards for the duration of the trip. Upon discovering someone had used my card info to make ~$200 in unauthorized purchases I became suspicious of the hotel and its software, which this company is responsible for.Regardless of this company's culpability re this specific event, upon doing a test transaction (subsequent to the discovery of fraud) on a white-labeled website this company is responsible for (ie their software used to book at one of their client hotels) I found they ingest financial *** directly on their servers, meaning they do not hash, encrypt, or even attempt basic obfuscation of the *** payload, including credit card info in plaintext. While I understand they implement SSL in transit, this is not enough and anyone who has processed a card transaction online knows or should know that a small company like this should not be ingesting financial *** directly, instead they should be making an embedded call to a reputable service like PayPal or Stripe or some banking institution with an actual reputation and proper security practices. Given this glaring oversight it's likely they also allow their clients or even employees access to plaintext *** payload (such as card information) which can facilitate fraudulent behavior and even possibly identity theft.