Back to Home
Security Overview
Security at AppDuniya
Security is built into every layer of how we work — from our infrastructure and development practices to how we handle your project data and client communications.
Last updated: August 2026 · Effective from: August 1, 2026
Data Encryption & Transmission
- All data transmitted between your browser and our servers is encrypted using TLS 1.2+ (Transport Layer Security) with AES-256 cipher suites.
- Our website enforces HTTPS across all pages with HTTP Strict Transport Security (HSTS) headers enabled.
- Sensitive form data (contact inquiries, email subscriptions) is transmitted over encrypted channels and never stored in plain text.
- We use secure, industry-standard email protocols (STARTTLS/SMTPS) for all automated transactional emails.
Infrastructure Security
- Our production infrastructure is hosted on enterprise-grade cloud providers (AWS, GCP, Azure) with ISO 27001 and SOC 2 Type II certifications.
- All servers are behind Web Application Firewalls (WAF) and DDoS mitigation systems to protect against volumetric attacks.
- We use private VPCs (Virtual Private Clouds) with strict network segmentation, ensuring databases are never publicly accessible.
- Automated security patching and vulnerability scanning run continuously across all production and staging environments.
Access Control & Authentication
- All internal team access to production systems requires Multi-Factor Authentication (MFA) and is role-based with least-privilege principles.
- Access credentials, API keys, and secrets are stored in encrypted vaults (e.g., AWS Secrets Manager, HashiCorp Vault) — never in source code.
- Client-facing systems use JWT-based session management with short expiry windows and automatic token rotation.
- Administrative access logs are retained for 12 months and reviewed periodically for anomalous activity.
Vulnerability Management
- We conduct quarterly automated vulnerability scans and annual manual penetration testing by certified security professionals (OSCP/CEH).
- Our engineering team follows OWASP Top 10 guidelines for all custom web application and API development.
- Third-party dependencies and libraries are monitored via automated tools (Dependabot, Snyk) for known CVEs and patched promptly.
- We maintain a responsible disclosure programme — if you discover a security vulnerability, please report it confidentially to us.
Monitoring & Incident Response
- Real-time monitoring tools (uptime alerts, error tracking, SIEM dashboards) are active 24/7 across all production environments.
- Our incident response plan defines clear escalation paths, containment procedures, and client notification timelines.
- In the event of a confirmed data breach affecting client data, we will notify impacted parties within 72 hours as required by applicable regulations.
- Post-incident Root Cause Analysis (RCA) reports are prepared for all severity-1 incidents and shared with affected clients.
Client Project Security
- All client projects are protected by NDAs signed before project kickoff. No project details are shared externally without explicit consent.
- Source code for client projects is stored in private, access-controlled repositories with branch protection and mandatory code review.
- Staging environments for client projects are protected by authentication and are never indexed by search engines.
- At project handover, all AppDuniya team access is revoked from client systems within 48 hours unless retainer support is agreed.
Found a Security Vulnerability?
We encourage responsible disclosure. Report security issues to our security team and we'll investigate promptly.
email@appduniya.co.in