Security

1. Our approach

Security is part of how we design, build and run every system — not a step added before launch. We apply the same practices to this website, our internal systems and the platforms we deliver for clients.

2. Secure development

• Threat modelling during design for systems that handle personal, financial or sensitive data.
• Peer code review for every change, with security checks against the OWASP Top 10.
• Automated dependency and static analysis scanning in CI/CD pipelines.
• Vulnerability assessment and penetration testing (VAPT) before major releases.

3. Data protection

• TLS encryption for data in transit and encryption at rest for databases, storage and backups.
• Secrets stored in managed vaults, never in source code.
• Data minimisation and retention limits aligned with the DPDP Act, 2023.

4. Access control

• Multi-factor authentication on all administrative and cloud accounts.
• Least-privilege, role-based access, reviewed regularly and removed promptly when people change roles.
• Audit logging of privileged actions.

5. Infrastructure and operations

• Hardened server configurations, security headers and regular patching.
• 24/7 monitoring and alerting, with documented incident response runbooks.
• Encrypted, tested backups and disaster recovery plans with defined recovery targets.

6. Incident response

If a security incident occurs we contain it, investigate the cause, inform affected clients without undue delay, and meet our reporting obligations under Indian law, including reporting to CERT-In within the prescribed timelines. A written post-incident review follows every significant incident.

7. Responsible disclosure

If you believe you have found a vulnerability in this website or a Cloudsect system, email contact@cloudsect.com with the subject "Security Report", a description and steps to reproduce. Please:

• Give us reasonable time to fix the issue before disclosing it publicly.
• Avoid accessing, changing or deleting data that does not belong to you.
• Do not run denial-of-service tests, social engineering or physical attacks.

We will acknowledge valid reports, keep you informed, and will not pursue legal action against good-faith research that follows these guidelines.