This is a public summary of the information security practices of VDHOSTS INTERNET PRIVATE LIMITED ("VD Hosts"). It describes what we do; it is not a guarantee that incidents cannot happen, and it does not claim certification against any standard unless we state that certification separately with evidence.
1. Governance
Security is owned by management, with defined responsibilities, a risk register reviewed regularly, and policies covering acceptable use, access, data handling, secure development, incident response and suppliers. Our practices draw on recognised frameworks such as ISO/IEC 27001, the NIST Cybersecurity Framework and the OWASP standards.
2. People
Staff and contractors sign confidentiality obligations, receive security awareness training, and have access removed promptly when they leave.
3. Access control
- Least-privilege, role-based access to systems and client data.
- Multi-factor authentication for staff access to administrative systems.
- Individual accounts only; no shared credentials.
- Periodic access reviews and logging of administrative actions.
4. Data protection
- Encryption in transit (TLS) for our websites and services.
- Passwords stored only as one-way hashes; secrets kept out of source code.
- Uploaded files stored privately, checked on upload, and available only through short-lived links.
- Data minimisation and retention limits as described in our Privacy Policy.
5. Secure development
Code review, automated tests, dependency and secret scanning, security headers and a Content-Security-Policy on our web applications, and security testing before significant releases.
6. Operations and monitoring
Patching on a defined schedule, monitoring and alerting, backups with restore testing, and time synchronisation and log retention in line with the CERT-In Directions of 28 April 2022.
7. Incident response
We maintain an incident response process. Incidents that fall within the CERT-In Directions are reported to CERT-In within six hours of being noticed; personal data breaches are notified to affected persons and authorities as required by law; and affected clients are informed under their agreements.
8. Suppliers
Suppliers who handle client or personal data are assessed and bound by written security and confidentiality obligations. See our Subcontractor and Third-Party Policy.
9. Business continuity
Backups are kept off-site, and recovery procedures are documented and tested.
10. Reporting a security issue
Please report suspected vulnerabilities to info@vdhosts.com under our Responsible Disclosure Policy.