We hold ourselves to what we sell.

1. Certifications and attestations

Here is exactly where we stand today. We would rather tell you we are mid-audit than let a badge imply otherwise.

We will update this section the day a status changes — not the quarter after. If your procurement process needs evidence of an in-flight audit, we can share the auditor's engagement letter and our current control matrix under NDA.

2. Data residency and hosting

India is our default region, and it is available to every customer. For RBI-regulated entities and organisations with DPDP-sensitive workloads, this means your data can remain within India for its entire lifecycle, including backups.

We also operate in additional regions for customers with operations outside India, or with their own residency requirements. Region is selected at onboarding and recorded in your agreement — it is not something we change unilaterally afterwards.

• Primary region: India
• Additional regions: available on request, selected at onboarding
• Backups remain within the region selected for the primary deployment
• Tenant isolation: customer data is logically segregated, with tenant identity enforced at the data access layer

Ask us for the current region list and provider detail for your deployment — we will put it in writing.

3. Data protection

• In transit: TLS 1.2 or higher for all connections, internal and external. HTTP is redirected, never served.
• At rest: AES-256 encryption for stored data and backups.
• Key management: keys held in a managed key management service, with rotation and access separated from the data they protect.
• Secrets: credentials and API keys are held in a secrets manager, never in source control.
• Minimisation: 4sight is a risk quantification and GRC platform. It is built around organisational risk data, not around personal data — we ingest the minimum personal data required to operate the product.
• Deletion: on termination, customer data is deleted within a defined window set out in your agreement, with certification of deletion available on request.

4. Access control

• Role-based access control within the platform, with customer-administered roles and permissions.
• Multi-factor authentication enforced for all TrustSphere staff on every system that touches customer data.
• Least privilege by default. Production access is limited to named personnel with an operational need, and is reviewed periodically.
• Access is logged; administrative actions are recorded in an audit trail available to customers.
• Joiner–mover–leaver process, with access revoked on the last working day.
• SSO / SAML integration available for enterprise deployments.

5. Secure development

• Peer review required on all changes before merge; no direct commits to the main branch.
• Separate development, staging and production environments. Production data is not used in development or testing.
• Automated dependency scanning, with alerts on known vulnerable packages.
• Static analysis and secret scanning in the build pipeline.
• Infrastructure changes are version-controlled and reviewed like application code.

6. Testing and vulnerability management

• Penetration testing: independent third-party testing of the 4sight platform, conducted at least annually and after significant architectural change. An executive summary is available to customers and qualified prospects under NDA.
• Vulnerability scanning: continuous scanning of infrastructure and dependencies.
• Remediation targets: critical findings within 7 days, high within 30 days, medium within 90 days, measured from confirmation.
• External reports: handled under the disclosure policy in section 12.

7. Resilience and continuity

• Automated encrypted backups, retained within the customer's selected region.
• Backup restoration tested periodically — a backup that has never been restored is not a backup.
• Documented business continuity and disaster recovery plans, reviewed annually.
• Recovery objectives are set out in customer agreements and are available on request during evaluation.

8. People security

• Background verification for personnel with access to customer environments, to the extent permitted by law.
• Confidentiality obligations in every employment and contractor agreement.
• Security awareness training at onboarding and annually, including phishing simulation.
• Defined acceptable use, device and remote working policies.
• Contractors and subprocessors are held to equivalent obligations by contract.

9. Subprocessors

This is the authoritative list of third parties who may process personal data on our behalf. It covers the public website; platform subprocessors for a specific deployment are listed in your agreement.

We notify customers in advance of adding or replacing a subprocessor that handles their data, on the terms set out in their agreement. To be notified of changes to this list, email security@trustspheretechnologies.com.

10. This website, specifically

Reviewers routinely ask what the marketing site itself does with data, so here it is separately from the platform:

• It is a static site. There is no application server, no database and no user accounts behind it. Form submissions are relayed by our email provider and are not stored on the website's infrastructure.
• The assessment tools compute in your browser. The CRQ and maturity calculations run locally on your device; progress is held in sessionStorage and cleared when you close the tab. Data reaches us only when you submit for a report.
• No cookies are set until you consent. Analytics loads only after you accept, and is configured to send the page path without query strings, so assessment answers are never handed to an analytics provider.
• Form content is escaped before it is rendered into notification emails, so submitted content cannot execute as markup on our side.
• All traffic is served over TLS with HTTP Strict Transport Security.

11. Incident response and breach notification

We maintain a documented incident response plan with defined severity levels, named responders and escalation paths.

• Security events are triaged on detection; confirmed incidents are escalated immediately.
• Affected customers are notified without undue delay, and in any case within the timeframe set out in their agreement.
• Personal data breaches are reported to the Data Protection Board of India and to affected Data Principals as required by the DPDP Act and its rules.
• We conduct a post-incident review on every confirmed incident and share the outcome with affected customers.

We will tell you what happened, when we knew, and what we changed. We would rather deliver an uncomfortable disclosure than a comfortable silence.

12. Vulnerability disclosure policy

If you have found a security issue affecting TrustSphere, we want to hear from you, and we will not take legal action against you for telling us.

How to report

Email security@trustspheretechnologies.com with enough detail to reproduce the issue — affected URL or component, steps, and impact. Our machine-readable contact details are published at /.well-known/security.txt.

What we commit to

• Acknowledgement within 2 business days.
• An initial assessment and triage decision within 10 business days.
• Progress updates until the issue is resolved.
• Credit in our acknowledgements, if you would like it.

In scope

• trustspheretechnologies.com and its subdomains
• The 4sight and TrustCore platforms, with prior written authorisation — contact us first and we will arrange it

Out of scope

• Denial of service, volumetric or stress testing of any kind
• Social engineering, phishing or physical attacks against our staff or offices
• Findings from automated scanners without a demonstrated, exploitable impact
• Missing best-practice headers or configuration with no demonstrated exploit path — tell us anyway, but they are informational
• Vulnerabilities in third-party services listed in section 9 — please report those to the provider

Safe harbour

If you act in good faith and within this policy — you avoid privacy violations, data destruction and service degradation; you access only the minimum data necessary to demonstrate the issue; you do not exfiltrate, retain or share data; and you give us reasonable time to remediate before public disclosure — we will treat your research as authorised, will not pursue or support legal action against you, and will work with you if a third party does.

We do not currently operate a paid bug bounty. We do offer our genuine thanks, public credit, and a fast, respectful response — which is more than most.

13. Frameworks: what we help you meet, vs. what we hold

These get conflated constantly, so we separate them explicitly.

Helping you achieve a standard is not the same as holding it. Any vendor that blurs that line in a sales conversation is telling you something about how they will handle your data.

14. Request documentation

Available to customers and qualified prospects, most under NDA:

• Completed security questionnaire (CAIQ, VSA, or your own template)
• Penetration test executive summary
• Current control matrix and ISMS scope statement
• Data processing addendum and standard contractual clauses
• Business continuity and disaster recovery summary
• Architecture and data flow diagrams
• Certificate of insurance

Email security@trustspheretechnologies.com and tell us what your review needs. We would rather answer thoroughly once than partially three times.

Related reading: Privacy Policy · Terms of Service · security.txt