DocumentationProvided for vendor assessments and tenders
Proven onAP Legislature — full entry audit trail
StandardsGIGW alignment, WCAG 2.1 AA target
What it means for your business
Win bigger clients
Documentation and controls that satisfy due diligence.
Reduce risk
Access control, encryption and monitoring built in.
Audit-ready
A clear record of who did what, and when.
Ideal for
Companies selling to enterprises, government or regulated sectors.
For your technical team
Least-privilege access, complete audit logging, stated data residency, and the documentation an institutional procurement team actually asks for — designed in from the start rather than assembled the week before an audit.
The problem
Security as a document, not a system
Most vendors treat security as a page in a proposal. The gap shows the moment an institutional buyer sends their assessment questionnaire and asks who can see production data, how access is revoked, and where the logs are.
Shared admin credentials that nobody can attribute an action to.
Production data copied into a developer environment "just for debugging".
Secrets in the repository, discovered during due diligence rather than before it.
No audit trail, so an incident cannot be reconstructed for the people it affected.
Defence in depth, layer by layer
The right-hand column is the point. These are the questions institutional procurement actually sends, and a firm that has answered them before answers them in a day rather than a month.
What you get
Deliverables, not activities.
Each of these is something that exists at the end and that you own.
01
Access model design
Roles derived from what people actually do, with least privilege as the default rather than the exception.
02
Audit logging
Immutable records of privileged and record-affecting actions, structured so a specific event can be reconstructed later.
03
Secrets and key management
Managed key stores, rotation, and nothing sensitive in source control — verified in the pipeline.
04
Pipeline security
Dependency and vulnerability scanning on every build, so problems surface before a reviewer finds them.
05
Data residency and retention
Stated per engagement, honoured in the deployment topology, and written into the contract rather than assumed.
06
Assessment documentation
The written answers to a vendor security questionnaire, prepared once and kept current, so a tender response takes days rather than weeks.
Technology
What this runs on.
Grouped the way a technical evaluator reads it. Everything listed is in production in work on this site.
01
Identity & access
RBACMFA on privileged accessTime-bound elevationNamed service accounts
02
Data protection
TLS in transitEncryption at restManaged key storesRetention policyResidency control
03
Pipeline
Dependency scanningSecret scanningEnvironment separationInfrastructure as code
04
Assurance
Immutable audit logsVAPT coordinationIncident runbooksPost-mortem process
The three things that decide whether this goes well.
Your security questionnaire or assessment template, as early as possible — ideally before architecture.
Whoever owns risk on your side, in the room for one session.
Any residency, retention or regulatory constraint that applies, stated up front.
Questions we get asked
Are you ISO 27001 certified?
Our current registrations and certifications are listed on the Trust page, kept honest — if it is not listed there, we do not hold it yet. The practices on this page apply regardless of certification status.
Do you run penetration testing?
We coordinate independent testing rather than marking our own homework, and we will work to a CERT-In empanelled auditor where your procurement requires one.
Can you complete our vendor assessment questionnaire?
Yes, and quickly. We keep the answers current between engagements precisely so this is not a three-week scramble.
Start here
Let’s build what’s next.
Tell us where your business wants to grow. In one conversation we will show you where AI and software will pay back first, and whether we are the right team to build it.
We look at your goals, your current systems and your biggest time and cost drains, then recommend the first AI or software move with the fastest payback.
