Trust & Security
We protect your trust the way we test your systems: rigorously.
Engaging a security firm means handing over the keys to your most sensitive weaknesses. These are the commitments we make in return — and the standards we are prepared to be held to.
Our commitments
How we handle your information and your trust
These commitments govern every Softous engagement. Where a formal policy applies, it is incorporated into our engagement agreements.
Authorisation before anything
We never test, scan or probe any system without written authorisation that defines scope, boundaries, timing and permitted techniques. This is a hard precondition of every engagement.
Client confidentiality
Everything we learn about your environment is confidential. We do not disclose client names, findings or engagement details without written approval — and never in marketing without explicit consent.
Responsible handling of sensitive findings
Vulnerability evidence is accessed only by the specialists assigned to your engagement, stored securely, and handled on a strict need-to-know basis.
Secure communication
Reports and sensitive material are shared through encrypted channels agreed with you at engagement start — never over unprotected email unless you explicitly request it.
Data protection practices
We collect the minimum data needed to deliver an engagement, retain it only as long as required, and securely destroy engagement data after the agreed retention period.
Reporting security
Reports are deliverables that contain your most sensitive weaknesses. They are encrypted at rest and in transit, watermarked where appropriate, and access-logged.
Responsible disclosure
If we discover a vulnerability in third-party software during an engagement, we follow coordinated disclosure principles — working with the vendor and protecting affected users.
Confidentiality agreements
We are happy to work under your NDA, and our own engagement agreements include confidentiality and data-handling terms as standard.
Report a security concern
Found a vulnerability in our own systems?
We practise what we preach. If you believe you have found a security issue affecting Softous Solutions, please report it to us at info@softous.in with the subject line “Security Disclosure”. We commit to acknowledging reports promptly, investigating in good faith, and not pursuing legal action against good-faith security researchers who act within responsible disclosure principles.
Due diligence
Evaluating us as a vendor? Ask the hard questions.
We welcome security due diligence. Speak with our team about our practices, policies and engagement safeguards.