Security

🔹 Security & Data Breach Response Policy

At Global Info Veda, we prioritize the security, confidentiality, and integrity of all user data and digital infrastructure. Our security framework is designed using globally accepted security standards and is enforced through a combination of technological safeguards, operational processes, and continuous training.

🔐 Enterprise-Grade Security Practices

Our digital systems are built and maintained with modern cybersecurity architecture, including:

  • TLS 1.3 enforced encryption for all data exchanges
  • AES-256 encryption at rest for PII and financial data
  • Zero Trust Security Model: all access is verified continuously across all endpoints
  • Cloud-native Web Application Firewalls (WAFs)
  • Runtime Application Self-Protection (RASP) tools integrated into production code
  • Immutable audit logging and SIEM integrations for tamper-proof event tracing
  • Decentralized credential vaults for API keys and admin access tokens

🧱 Secure-by-Design Architecture

All platforms are built with the OWASP Top 10 security risks in mind, incorporating:

  • Input sanitization, XSS/CSRF tokenization, and anti-SQLi checks
  • Rate-limiting and captcha mechanisms to prevent brute force attacks
  • Secure cookie flags (HttpOnly, SameSite=Strict, Secure)
  • Automated regression testing after every build cycle

📦 Cloud & Infrastructure Security

We deploy our applications on multi-region cloud zones with built-in resiliency:

  • Infrastructure providers: Amazon Web Services (AWS) & Google Cloud Platform (GCP)
  • Certifications: All providers hold SOC 2 Type II, ISO 27001, and FedRAMP compliance
  • Geo-fencing and network segmentation for regional access governance
  • Full-stack data encryption during replication, backup, and archival

🔒 Data Privacy, Handling & Retention

  • Granular access control (RBAC/ABAC) with dynamic provisioning
  • All user data is stored encrypted and access is monitored 24/7
  • Data retention limits: logs = 180 days, billing = 5 years, PII = retention as per consent/law
  • Deletion, rectification, and export rights are honored as per GDPR and global equivalents
  • Data masking and pseudonymization are applied where full access is not required

👥 Internal Security Governance

  • All employees sign NDAs and undergo annual secure coding and compliance training
  • Access to environments is logged, reviewed quarterly, and revoked upon termination
  • Devices used by staff must have EDR/XDR, VPN, and full-disk encryption enabled

📱 User Security Measures & Best Practices

To help users maintain security on their end:

  • Passwords must be 12+ characters with complexity enforced
  • Two-Factor Authentication (2FA) is recommended for all user accounts
  • Session timeout, single-device login, and login notification features are enabled
  • Security questions are optional and stored hashed

🚨 Incident Response & Breach Management

We follow a globally compliant data breach incident protocol:

  1. Detection & Alerting via SIEM and intrusion detection tools
  2. Initial Containment with access restrictions and traffic isolation
  3. Impact Assessment including affected data scope and regulatory exposure
  4. Notification Timeline:
    • EU: 72 hours (GDPR Art. 33)
    • U.S.: varies by state law
    • India: 6 hours (CERT-IN directive)
  5. Regulator Communication: CERT-IN, DPA, FTC, ICO, as needed
  6. Remediation: credential resets, patch deployment, infrastructure rebuild
  7. Post-incident Forensics: full RCA and improvement plan logged

🌍 Legal, Regulatory & Ethical Frameworks

We comply with the following global laws and standards:

  • GDPR (EU) and UK GDPR
  • CCPA/CPRA (California)
  • IT Act, 2000 (India) with SPDI rules
  • ISO/IEC 27001, 27701, 22301, 27017, 27018
  • NIST Cybersecurity Framework (U.S.)
  • PCI-DSS (for payment gateways, card data handling)
  • SOC 2 Type II controls for service operations

🧪 External Security Testing & Certification

We work with certified cybersecurity vendors for:

  • Quarterly vulnerability scans and annual penetration testing
  • Supply chain risk reviews (SBOM/SSDF compliance)
  • Endpoint security compliance audits (M1/Windows/Linux)

🤝 Responsible Vulnerability Disclosure Program

Security researchers, ethical hackers, and technical users may report vulnerabilities to us:

  • Submit via security@globalinfoveda.com
  • Include details, severity, reproduction steps, and proof-of-concept
  • No legal action will be taken against ethical disclosures in good faith

We offer public acknowledgment and potential bounties for critical, confirmed vulnerabilities.

🔹 16. Contact for Security Concerns

For all technical, legal, or emergency security matters:

Information Security Office
Global Info Veda
📧 security@globalinfoveda.com
📧 legal@globalinfoveda.com

Standard queries are answered within 5 business days. Critical threats or zero-days are acknowledged within 12–24 hours.