Security
Security-first engineering, described in practice
What we actually do when we build, host and support your systems, and what we do not yet claim.
Plain statement
“Security-first” is only worth saying if it changes how work is done. Below is what it means at Vetra. Each item is a practice we follow on every project, not an aspiration.
How we build
- Security at design time. We list what the application must protect and who might attack it, before we write code.
- Code review. Changes are reviewed before they are released.
- Dependency checks. We scan third-party packages for known vulnerabilities and update them as part of maintenance.
- Secrets handled safely. Passwords, keys and tokens are kept out of source code and stored in protected configuration.
- Least privilege. People and services get only the access they need, and access is removed when a person leaves a project.
- Safe by default web practices. Input validation, output encoding and a strict content security policy to reduce cross-site scripting and injection risk. This website itself is built this way.
- Test data, not real data. We do not use your live personal data in development without your written agreement.
How we host and operate
- HTTPS everywhere, with certificates renewed automatically.
- Multi-factor authentication on the accounts we use to manage your systems.
- Operating-system and package updates applied on a schedule stated in your service levels.
- Firewall rules limited to the ports a service needs.
- Daily backups, with restore tests on a schedule stated in your service levels.
- Logs of administrative access, kept for the period stated in your agreement.
If something goes wrong
- We contain the problem first, then investigate.
- We tell affected clients without undue delay once we confirm an incident that affects their data. Your contract states the notification target.
- You receive a written summary of what happened, what was affected, and what we changed.
What we do not claim
Vetra Tech Solutions does not currently hold SOC 2, ISO 27001 or similar certifications, and we do not claim compliance with any framework unless we state it in your contract. We can map our practices to your own controls and complete your vendor security questionnaire. If you require a certification, tell us at the start.
No system is perfectly secure, and we do not promise that incidents will never happen. We promise the practices above, and an honest account if something fails.
Reporting a vulnerability
If you believe you have found a security problem in this website or in something we operate, email support@vetratech.in with the details. Please give us a reasonable time to fix it before sharing it publicly and do not access data that is not yours. We will acknowledge your report and keep you informed. Our security.txt has the same details.