As a cybersecurity firm, Security Brigade holds itself to the highest security standards. We understand that our clients entrust us with sensitive security data, and we treat the protection of that data as a fundamental obligation, not merely a compliance checkbox.
2. Infrastructure Security
Encryption in Transit: All data transmitted between your browser and the Platform is encrypted using TLS 1.2 or higher. We enforce HTTPS across all endpoints with HSTS headers.
Encryption at Rest: Database storage uses encrypted volumes. Backups are encrypted before transfer and storage.
Network Security: The Platform infrastructure is protected by firewalls, intrusion detection systems, and DDoS mitigation (Cloudflare). Access to production systems is restricted to authorised personnel via VPN and SSH key authentication.
Server Hardening: Production servers follow CIS benchmarks for hardening. Unnecessary services and ports are disabled.
3. Application Security
Authentication: Multi-factor authentication, IP whitelisting, session management with configurable timeouts, and CSRF protection on all state-changing operations.
Authorisation: Role-based access control (RBAC) ensures users can only access data belonging to their organisation and projects they are authorised to view.
Input Validation: All user inputs are validated and sanitised to prevent injection attacks (SQL injection, XSS, etc.).
Security Headers: The Platform sets Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, and Referrer-Policy headers.
Error Handling: Application errors are logged to our self-hosted GlitchTip instance. Error messages shown to users do not expose internal system details.
4. Access Controls
Principle of Least Privilege: Team members are granted the minimum access necessary for their role.
Static IP Whitelisting: Organisations can restrict Platform access to specific IP addresses.
Login Monitoring: All login attempts are logged. Users can review their login history within the Platform.
Rate Limiting: Login endpoints and password reset flows are rate-limited to prevent brute-force attacks.
5. Data Protection
Data Isolation: Each client's data is logically isolated. Access controls enforce strict separation between client datasets.
Backup and Recovery: Regular automated backups with tested restoration procedures. Backup data is encrypted and stored securely.
Data Retention: Data is retained only for the duration of the service agreement plus a 90-day wind-down period, after which it is securely deleted.
6. Monitoring and Incident Response
Continuous Monitoring: Server and application metrics are monitored 24/7. Anomalous activity triggers automated alerts.
Incident Response: We maintain a documented incident response plan. Critical incidents are communicated to affected clients within 24 hours.
Vulnerability Management: We regularly scan our own infrastructure and apply security patches promptly. As a penetration testing firm, we subject our own systems to rigorous testing.
7. Organisational Security
Employee Vetting: All Security Brigade team members undergo background verification.
Security Training: Ongoing security awareness training for all staff.
Confidentiality Agreements: All employees and contractors sign non-disclosure agreements.
8. Compliance
Security Brigade's operations are aligned with:
ISO/IEC 27001 (Information Security Management)
OWASP Application Security Verification Standard (ASVS)
CERT-In guidelines for cybersecurity
GDPR and DPDP Act, 2023 data protection requirements
9. Reporting Security Concerns
If you discover a security issue with the Platform, please report it via our Responsible Disclosure programme. For general security enquiries, contact [email protected].