Trust & security
We are audited by the same standard we audit to.
A firm that tests other people’s controls should be able to describe its own without being asked twice.
01
What we hold, and what we align to.
Two different claims, and conflating them would be the first finding against us.
Credentials held by our people
- DISA
- FAFD
- ISC2 CC
- DPCAC
Frameworks our delivery aligns to
- RBI ITGRCA
- SEBI CSCRF
- IRDAI
- CERT-IN
- DPDP ACT 2023
- ISO/IEC 27001
- SOC 2
- NIST CSF
- COBIT
Alignment statements describe how we scope and test an engagement. They are not certification claims, and Accurith does not hold an organisational certification against any of the frameworks above.
02
01
Data residency
Application and database run in the United States (us-west). Cross-border transfer is permitted under DPDP 2023 §16–17 absent a negative list. If residency becomes binding for your engagement, say so at scoping — it changes the hosting decision, not the work.
02
Transport and headers
TLS terminated at the edge, HSTS enabled, and a Content-Security-Policy carrying a per-request nonce with strict-dynamic. script-src never contains unsafe-inline.
03
Personal data
Enquiry and application records are stored in Postgres and emailed to a team inbox. Erasure requests are handled manually on request to the privacy address below.
04
Access
Least privilege on the hosting and database consoles, with credentials held by named individuals rather than shared accounts.
03
Report a vulnerability.
We will acknowledge within two business days and will not pursue anyone acting in good faith.
General enquiries: [email protected]