Security

Security is the product we sell, and the discipline we hold ourselves to. This statement describes the technical and organisational measures PhishSheriff uses to protect the Services and the data entrusted to us. It is written for the security, IT and procurement teams who evaluate us.

1. Our Security Commitment

PhishSheriff implements industry-standard technical and organisational measures to preserve the confidentiality, integrity and availability of information, and to protect data from unauthorised access, use, loss, destruction or disclosure. Security is embedded across our people, processes and technology, and is reviewed on an ongoing basis. No system is impenetrable, and we do not claim absolute security; we do commit to a layered, defence-in-depth approach and to continuous improvement.

2. Security Governance

Our security programme is owned by a designated security function and supported by documented policies covering acceptable use, access management, data protection, change management and incident response. Personnel undergo background verification consistent with applicable law, receive security and privacy training, and are bound by confidentiality obligations. We operate a risk-management process to identify, assess and treat security risks on a recurring basis.

3. Data Protection and Encryption

We encrypt data in transit over public networks using industry-standard protocols (TLS), and we encrypt sensitive data at rest. Encryption keys are managed with restricted access and periodic rotation. Data is logically segregated between customers, and access to production data is limited to the minimum necessary to operate and support the Services.

4. Access Control and Authentication

Access to systems and data follows the principles of least privilege and need-to-know. We use role-based access control, unique user credentials, and multi-factor authentication for administrative and remote access. Access rights are reviewed periodically and revoked promptly when no longer required or on termination.

5. Application Security

Security is built into our development lifecycle. Changes go through code review and testing before release, dependencies are monitored for known vulnerabilities, and environments are separated between development, staging and production. We perform vulnerability assessments and remediate identified issues according to their severity.

6. Infrastructure and Network Security

The Services run on hardened, reputable cloud infrastructure. Networks are segmented, administrative interfaces are restricted, and firewalls and security groups limit traffic to what is required. We apply timely patching, protect against common network threats, and log security-relevant events for review.

7. Monitoring, Logging and Incident Response

We monitor systems for anomalous activity and retain security logs to support detection and investigation. We maintain a documented incident-response plan with defined roles, containment and recovery steps, and post-incident review. In the event of a security incident affecting personal data, we will act in accordance with applicable law and notify affected parties as required. Suspected incidents can be reported to technology@phishsheriff.com.

8. Business Continuity and Backups

We maintain regular, protected backups of critical data and configuration, and we design the Services for resilience and recovery. Backup and recovery processes are tested periodically so that we can restore service and data within targeted recovery objectives following disruption.

9. Vendor and Sub-processor Management

We assess the security and privacy practices of vendors and sub-processors that handle data on our behalf before engaging them, and we bind them to appropriate confidentiality and data-protection obligations. As noted in our Privacy Policy, some vendors may be located outside of India; where that is the case, we take steps intended to keep the protection of your data consistent with this statement.

10. Data Residency and Retention

We retain personal and customer data only as long as necessary to provide the Services and to meet legitimate business and legal obligations, as described in our Privacy Policy. Details of where the Services are hosted and any data-residency options are available on request.

11. Audits and Compliance

Our security programme is designed to align with leading international standards and with the Information Technology Act, 2000 and the rules made thereunder. Independent audit reports and assessment summaries are available on request, under NDA.

12. Responsible Disclosure

We welcome reports from the security community. If you believe you have found a vulnerability in our Services, please report it to technology@phishsheriff.com with enough detail for us to reproduce it. Please act in good faith, avoid privacy violations and service disruption, and give us a reasonable opportunity to remediate before any public disclosure. We will acknowledge valid reports and keep you informed of our progress.

13. Contact

For security questions, documentation requests or to report a concern, contact us at technology@phishsheriff.com or write to us at 1st Floor, A Wing, Lodha iThink Techno Campus, Pokhran Road No. 2, Off Eastern Express Highway, Thane, Mumbai, Maharashtra.