Security at ShieldX

Our data handling practices are designed to align with the Digital Personal Data Protection Act, 2023. Purpose limitation, data minimisation, and consent management are built into our processing workflows — not bolted on after the fact.

Vulnerability assessment and penetration testing has been carried out by an independent third party. The report is available to prospective and existing clients under NDA as part of vendor due diligence.

We are actively working towards ISO/IEC 27001:2022 certification for our information security management system. Controls across access management, incident response, vulnerability management, and business continuity are being implemented and documented. We are not SOC 2 audited.

Role-based access control is enforced in the application, with MFA on all accounts and immediate session revocation. Infrastructure access is key-based and limited to named individuals.

Personal data is encrypted at the column level with AES-256-GCM under KMS-managed keys, rotated annually. Backups and object storage use AES-256 server-side encryption. Data in transit is protected with TLS 1.2 or higher.

Decisions and administrative actions are written to append-only, hash-chained logs. Any later edit, deletion or reordering breaks the chain and is surfaced by an on-demand integrity check. PII access is recorded insert-only. Records are browsable per account and per period, and produced for auditors on request.

Security events are monitored continuously through metrics and log-based alerting. Affected parties are notified within the timelines required under applicable Indian regulations, including the CERT-In reporting window.