Security at ShieldX

Our data handling practices are designed to align with the Digital Personal Data Protection Act, 2023. Purpose limitation, data minimisation, and consent management are built into our processing workflows — not bolted on after the fact.

We are actively working towards ISO/IEC 27001:2022 certification for our information security management system. Controls across access management, incident response, vulnerability management, and business continuity are being implemented and documented.

Role-based access controls are enforced across all internal systems. Engineers access only what their role requires. Access reviews are conducted periodically. No standing privileged access to production environments.

All data is encrypted at rest using AES-256. All data in transit is protected using TLS 1.2 or higher. Keys are managed through dedicated key management infrastructure and rotated regularly.

Every decision, access event, and configuration change is logged to an immutable audit trail. Logs cannot be altered or deleted by application-layer operations. Exportable for regulatory review on demand.

We maintain a documented incident response plan covering detection, containment, investigation, and notification. Security events are monitored continuously. Affected parties are notified within timelines required under applicable Indian regulations.