LoadingLoading
LoadingTrust & security
A firm that tests other people’s controls should be able to describe its own without being asked twice.
Two different claims, and conflating them would be the first finding against us.
Credentials held by our people
Frameworks our delivery aligns to
Alignment statements describe how we scope and test an engagement. They are not certification claims, and Accurith does not hold an organisational certification against any of the frameworks above.
Data residency
Application and database run in the United States (us-west). Cross-border transfer is permitted under DPDP 2023 §16–17 absent a negative list. If residency becomes binding for your engagement, say so at scoping — it changes the hosting decision, not the work.
Transport and headers
TLS terminated at the edge, HSTS enabled, and a Content-Security-Policy carrying a per-request nonce with strict-dynamic. script-src never contains unsafe-inline.
Personal data
Enquiry and application records are stored in Postgres and emailed to a team inbox. Erasure requests are handled manually on request to the privacy address below.
Access
Least privilege on the hosting and database consoles, with credentials held by named individuals rather than shared accounts.
We will acknowledge within two business days and will not pursue anyone acting in good faith.
General enquiries: info@accurith.com