DRUPTO operates a risk-based security program aligned with the criteria of SOC 2 (Security, Availability and Confidentiality trust services criteria) and the practices of ISO/IEC 27001. We have not sought formal certification; if your procurement process requires a SOC 2 Type II report or ISO 27001 certificate from your vendors, tell us — we support alternative assurance (questionnaires, remote audits, contractual commitments) in the meantime.
1. Encryption
- All data in transit is encrypted with TLS 1.2+ (HTTPS enforced site-wide, with HSTS and preloading).
- Data at rest — databases, object storage and backups — is encrypted with AES-256 by our cloud providers.
- Secrets and API keys are stored in environment variables and secret managers, never in source code.
2. Access Control
- Least-privilege access: personnel see only the systems and data their role requires.
- Multi-factor authentication is required for all administrative access to production systems and cloud consoles.
- Access is reviewed at least quarterly and revoked within 24 hours of a role change or departure.
- Client project data is logically separated per engagement; production data is never used in development or demos.
3. Secure Development
- Every change is peer-reviewed before it reaches production; main branches are protected.
- Automated dependency and vulnerability scanning runs on every build.
- Staging environments mirror production without real client data.
- Security-relevant fixes are prioritized ahead of feature work.
4. Infrastructure Hardening
- Serve hardened security headers on every response: Content-Security-Policy, Strict-Transport-Security (preload), X-Content-Type-Options, X-Frame-Options and a strict Referrer-Policy.
- Third-party origins are allow-listed explicitly; frame embedding and object tags are disabled.
- Database-level Row Level Security restricts administrative data to authenticated staff only.
5. Backups and Continuity
- Databases run with automated daily backups and point-in-time recovery windows provided by the hosting platform.
- Backups are encrypted at rest with the same AES-256 standard as live data.
- Restore procedures are documented and tested; the production build is reproducible from source at any commit.
6. Incident Response
- Documented incident-response runbook: detect, contain, eradicate, recover, review.
- Clients whose data is affected are notified without undue delay and within 48 hours of discovery (see DPA Section 8).
- Regulatory notifications (GDPR 72-hour window, DPDP Act, others) are coordinated with the client as controller.
- Every incident receives a written post-mortem with remediation actions tracked to closure.
7. People and Process
- All personnel and contractors sign confidentiality agreements before accessing any client system.
- Security-awareness training covers phishing, credential hygiene and data handling.
- Client access is provisioned per engagement and removed at project end.
8. Responsible Disclosure
Found a vulnerability in one of our systems or products? Email contact@druptoconsultants.com with reproduction steps. We acknowledge reports within 3 business days, keep you informed, and credit researchers who report in good faith (with your permission). Please avoid accessing other clients' data, degrading service, or social engineering while testing.
9. Vendor Assurance
Every infrastructure vendor is assessed before onboarding and bound by data-protection terms — the current list with purposes and regions lives on our Sub-processors page. Need a completed security questionnaire or a vendor-assessment pack? Email contact@druptoconsultants.com and we typically respond within 3 business days.