Trust & Security
We help companies find security vulnerabilities. That means we handle sensitive information every day. Here's how we protect it — and you.
Our Security Principles
These aren't marketing claims. They're operational commitments we measure ourselves against.
Confidential by Default
Your data, findings, and business context are never shared, sold, or used for marketing purposes. Period. We treat every client engagement as confidential unless explicitly agreed otherwise.
Minimal Data Retention
We only keep data as long as needed to serve you. Assessment data is deleted 90 days after project completion unless you request otherwise. We don't hoard information "just in case."
Encryption Everywhere
All data is encrypted in transit (TLS 1.3) and at rest (AES-256). Communications, reports, and findings are protected at every stage.
Need-to-Know Access
Only team members directly working on your engagement have access to your data. We use role-based access controls and audit logs for all sensitive operations.
How We Protect Your Data
Specific practices, not vague promises.
Secure Infrastructure
Our systems run on hardened cloud infrastructure with automated security patching, network segmentation, and continuous monitoring. We practice what we preach.
Strong Authentication
All team members use hardware security keys (YubiKey) for authentication. No passwords, no SMS codes — only phishing-resistant authentication.
Background-Checked Team
Every team member goes through background verification before handling client data. We take personnel security as seriously as technical security.
NDA by Default
Every engagement includes a mutual NDA. Your findings, vulnerabilities, and business context are legally protected. We never reference clients without explicit permission.
Secure Report Delivery
Reports are delivered via encrypted channels with time-limited access links. No sensitive findings in email bodies — ever.
Isolated Testing Environments
When we conduct assessments, we use isolated environments and secure VPNs. Client data never touches shared infrastructure.
SOC 2 Aligned Practices
Our internal processes are designed to meet SOC 2 Type II requirements. While we're not yet certified (we're transparent about that), we follow the same controls we help our clients implement.
🐛 Responsible Disclosure
Found a security issue in our systems? We appreciate responsible disclosure and take all reports seriously.
How to report: Email security findings to security@secuvia.in with details of the vulnerability. We'll acknowledge within 24 hours and work with you on remediation.
What we commit to:
- Acknowledge your report within 24 hours
- Provide regular updates on remediation progress
- Credit you publicly (if you wish) once fixed
- Never take legal action against good-faith researchers
Questions About Our Security?
We're happy to answer questions about how we handle your data. Transparency builds trust.
Contact Us