This page describes how iViRTH approaches information security. It states what we do and, just as importantly, what we do not claim. It is an overview, not a contractual commitment; commitments for an engagement are set in its written agreement.
1. Our approach
We design for least privilege, auditability and separation of public from confidential information. Controls are proportionate to the data involved and agreed per engagement.
2. This website
- Served over encrypted connections (HTTPS) with security headers configured at the host (content-type protection, referrer policy, frame restrictions, permissions policy).
- A static site: no user accounts, no database and no server-side form processing, which greatly reduces exposure.
- No advertising or tracking cookies and no third-party scripts or fonts are loaded; fonts and code are self-hosted.
- The enquiry form hands your message to your own email app; nothing is stored by the site.
3. Client and project data
- Access control: role-based access, least privilege, and removal of access when no longer needed.
- Audit trails: source, responsible party, version and change history for records, where the module is implemented.
- Separation: confidential supplier, commercial, personal or operational data is never shown on public passport pages.
- Transfer: data is exchanged by agreed secure channels, not by unprotected email, wherever practical.
- Minimisation: we ask only for data needed for the agreed scope.
4. People and suppliers
Staff and contractors with access to client data are bound by confidentiality obligations. Service providers are selected for appropriate security practices and engaged on terms that protect the data they handle.
5. Incident response
If we detect a security incident that affects personal or client data, we investigate, contain it, and notify affected parties and authorities as the law and the engagement agreement require, without undue delay.
6. Responsible disclosure
If you believe you have found a vulnerability, email hello@ivirth.in with “Security” in the subject. Please give enough detail to reproduce it, avoid accessing or changing data that is not yours, do not disrupt the service, and allow us a reasonable time to fix it before disclosure. We will acknowledge good-faith reports and will not pursue action against research that follows these rules.
7. What we do not claim
Unless stated and evidenced in writing, we do not claim formal security certifications (for example ISO/IEC 27001 or SOC 2), independent penetration-test results, or that any system is immune to attack. No system can be completely secure.
8. Your responsibilities
Protect credentials issued to you, tell us promptly of suspected misuse, and do not upload data you are not entitled to share.
9. Contact
Email hello@ivirth.in with “Security” in the subject, or use the contact page. iViRTH, Uttar Pradesh, India.