Security & compliance, transparently.

All traffic secured with TLS 1.2+.

Data encrypted at rest with AES-256.

Encryption keys are managed in AWS Key Management Service, access-controlled through IAM and rotated on a defined schedule.

API keys and application secrets are stored in AWS Secrets Manager and are never placed in source code, configuration or logs.

Information is classified across four tiers (Public, Internal, Confidential, Restricted) with handling rules for each.

Retention periods are defined per data type; visitor data defaults to 3 years and is customer-configurable.

Customer data is securely deleted within 30 days of contract termination, with confirmation on request.

All Indian-deployment data is hosted in the AWS Asia Pacific (Mumbai) region, keeping data in India.

SAML/OIDC SSO for enterprise customers.

Multi-factor authentication required for all staff.

Access follows role-based least-privilege; users receive only the access their role requires.

Cloud (IAM) and application access is formally reviewed every six months and findings tracked to closure.

Enforced minimum length, complexity, history, rotation and lockout across all accounts.

Privileged access is restricted to named individuals, protected by MFA, via bastion hosts, and logged.

Access is provisioned, adjusted and revoked promptly as people join, change role or leave.

24/7 monitoring and alerting across systems.

Production is isolated from non-production; databases and internal services are not exposed to the internet.

AWS GuardDuty provides continuous, intelligent threat detection across the environment.

AWS CloudTrail maintains a tamper-evident audit trail of API and account activity.

Security patches are applied on severity-based SLAs, tested before release, with rollback.

CrowdStrike endpoint protection is deployed on company devices and kept current.

Company devices are enrolled in Esper MDM with encryption, lock and remote-wipe.

Third-party pen tests performed annually.

An ISO/IEC 27001:2022-aligned ISMS governs the security programme, under Group CISO oversight.

Formal risk assessment and treatment is run at least annually and on significant change.

All staff complete security-awareness training at induction and at least annually.

Suppliers are risk-assessed and bound by data-protection agreements; sub-processors are published.

Changes are assessed, approved by a change board and implemented with rollback.

A defined IR process applies; customers are notified within 24h and regulators within 72h of a confirmed breach.

Security is built into every phase of development, with threat modelling and quality gates.

SonarQube runs on every code change and blocks merges with high or critical findings.

Third-party dependencies are continuously scanned against CVE data and remediated to SLA.

Every change is peer-reviewed before merge; direct pushes to protected branches are blocked.

Findings are scored on CVSS and remediated within severity-based SLAs, then retested.

Internet-facing endpoints are protected by AWS WAF against common web attacks.

The database and compute tiers run Multi-AZ on AWS with automatic failover.

A documented BCP covers critical services with defined recovery objectives, tested regularly.

A DR plan defines RTO/RPO and is validated through an annual failover drill.

Automated encrypted backups with point-in-time recovery; restores are tested annually.

Personal data is processed in line with India's DPDP Act 2023 and the GDPR where applicable.

A documented process handles access, correction, erasure and portability requests within 30 days.

A lawful-basis / data-processing register documents each processing activity and its basis.

Staff are background-verified before joining and bound by confidentiality agreements.