Security Policy

Architecture Security

• Zero Trust Architecture: No implicit trust for any user, device, or request. mTLS, RBAC, MFA enforced at every layer
• Encryption: AES-256 at rest, TLS 1.3 in transit, HSM key management, field-level encryption for PII
• Infrastructure: AWS Mumbai (ap-south-1) with VPC isolation, private subnets, and WAF protection
• Access Control: Least-privilege RBAC, privileged access management, mandatory MFA for all admin operations

Application Security

• OWASP Top 10 mitigations built into the SDLC
• Automated SAST and DAST in CI/CD pipeline
• Dependency vulnerability scanning on every build
• Penetration testing conducted at least annually by accredited third parties

Incident Response

TruveriX maintains a documented Security Incident Response Plan with defined roles, escalation paths, and SLAs. Critical vulnerabilities are patched within 72 hours. Personal data breaches are reported to the Data Protection Board of India within 72 hours of discovery, per DPDPA obligations.

Responsible Disclosure

If you discover a security vulnerability in TruveriX's systems, please report it responsibly to security@truverix.com. We commit to acknowledging reports within 48 hours and providing a resolution timeline within 5 business days.