Security & Compliance
Effective Date: 25 July 2024
Last Updated: 23 October 2026
At Vyturr Tech, we recognize the importance of protecting information entrusted to us. We aim to maintain appropriate security practices, protect the confidentiality and integrity of data, and address applicable privacy and regulatory requirements.
This page describes our approach to information security, data protection, infrastructure, and compliance. Our specific controls and commitments depend on the services used, the type of information processed, and the applicable contractual and legal requirements.
We are committed to providing accurate information about our security practices and will update this page as our controls, infrastructure, and compliance programs evolve.
1. Data Hosting and Residency
We use technology infrastructure and service providers to operate our website and, where applicable, our products and services.
- Hosting provider: We support multiple hosting providers such as AWS, GCP, Azure, and Hetzner. The choice of Hosting Provider is executed as per the customer’s requirements.
- Primary hosting region: As per the customer’s hosting requirements and geographical jurisdiction.
- Data storage locations: Configured specifically to meet the data sovereignty requirements of each country or region.
- Data residency commitments: Data is restricted to specific geographic regions as defined in the customer’s Statement of Work (SOW).
Depending on the service and configuration, personal information and other data may be processed or stored in multiple locations. These may include primary infrastructure, backup environments, monitoring systems, and third-party service providers.
Where applicable, international transfers of personal information will be handled in accordance with relevant data protection laws and contractual obligations. Customers with specific data residency requirements should contact us to confirm whether their requirements can be supported before submitting or transferring data.
2. Encryption and Data Protection
Encryption can help protect information against unauthorized disclosure. Our encryption practices and coverage depend on the systems and services used and customer specifications.
Encryption in Transit
Current implementation: HTTPS/TLS is enforced across the website, APIs, and relevant service connections. Where supported and configured, encrypted connections help protect information transmitted between users, applications, and our infrastructure.
Encryption at Rest
Current implementation: Databases, storage volumes, object storage, backups, and other applicable data stores are encrypted at rest using industry-standard algorithms (e.g., AES-256).
Encryption Key Management
Current implementation: Encryption keys are managed via secure, cloud-native Key Management Services (e.g., AWS KMS, Azure Key Vault) dictated by the chosen hosting provider. Access to keys is restricted to authorized infrastructure personnel on a strict least-privilege basis. Key rotation is automated annually or configured according to specific customer requirements.
We review encryption and key-management practices as part of our broader approach to protecting information.
3. Access Control and Least Privilege
Access to systems and information is limited to authorized individuals who require it for legitimate business purposes and project execution.
Our access-control approach includes:
- Role-based access control (RBAC).
- Least-privilege access principles.
- Authentication requirements appropriate to the system and risk.
- Multi-factor authentication (MFA) enforced across all internal and managed environments.
- Access approval and revocation procedures.
- Periodic access reviews.
- Logging and monitoring of relevant access events.
Current implementation: RBAC, MFA, and Least Privilege are implemented across all Vyturr Tech internal systems and managed customer environments. Custom access controls are applied based on specific customer SLAs.
Privileged access management: Administrator and production access is granted exclusively through formal ticketing and approval workflows, monitored via cloud-native audit logs, and revoked immediately upon project completion or employee offboarding.
Access review frequency: Conducted quarterly, or at intervals specified by individual customer contracts.
Access to production systems and sensitive information is governed by documented procedures appropriate to the sensitivity of the data and the risk associated with the access.
4. Privacy and GDPR
Where the General Data Protection Regulation (GDPR) applies, we aim to handle personal data in accordance with applicable data protection requirements.
GDPR role: Vyturr Tech generally acts as a Data Processor for data provided by our customers, and as a Data Controller for our internal business operations and employee data.
Data processing agreement: Data Processing Agreements (DPAs) are available and executed as part of our Master Service Agreements for applicable business customers.
International transfer safeguards: International data transfers rely on Standard Contractual Clauses (SCCs) and customer-approved secure architectures where required.
Data protection contact: info@vyturr.com
GDPR applicability and obligations depend on the circumstances of the processing. Publication of this page does not, by itself, establish GDPR compliance or certification. For further information about how we collect, use, and retain personal information, please refer to our Privacy Policy.
5. Japan: My Number and Specific Personal Information
Japan’s Individual Number, commonly known as My Number, is subject to specific legal requirements under Japan’s relevant laws and regulations.
Current My Number handling status: Not collected or processed by default.
Systems or services that handle My Number: None natively supported. If an IT services contract specifically requires the handling of My Number data, custom architectures and data isolation procedures are built to spec.
Applicable safeguards and operational procedures: Governed strictly by localized, customer-approved Data Processing Agreements and isolated Japanese data regions when bespoke development is requested.
We will not claim compliance with Japan’s My Number requirements without verifying the relevant processing activities and controls for a specific client deployment.
6. Security Certifications and Assurance
We recognize that independent assurance can help customers assess an organization’s security program.
ISO/IEC 27001 & SOC 2
- Current status: Vyturr Tech aligns its internal security policies and managed IT services with ISO/IEC 27001 and SOC 2 frameworks. Formal, independent certification audits are scheduled in alignment with our corporate roadmap and customer demand.
Where available, relevant assurance documentation or security questionnaires may be completed and shared with eligible customers under an NDA.
7. Vulnerability Management and Penetration Testing
We aim to identify and address security weaknesses in the systems that support our website and services.
Penetration testing status: Independent penetration testing is performed based on customer requirements and internal risk assessments.
Testing frequency: Quaterly for core internal infrastructure; frequency for customer environments is dictated by the client’s SLA and contract.
Testing scope: Cloud infrastructure, web applications, and APIs.
Testing provider: Verified third-party security vendors (subject to customer approval for managed environments).
Remediation process: Vulnerabilities are assessed, scored via CVSS, prioritized by risk level, and tracked in our internal project management systems until verified as resolved.
Security researchers who believe they have identified a vulnerability should contact us using the details in the Contact Us section.
Vulnerability disclosure policy: Available upon request.
8. Backups and Disaster Recovery
Backup and recovery arrangements help support service continuity and data recovery following accidental deletion, infrastructure failure, or other disruptive events.
Backup coverage: Production databases, code repositories, internal systems, and specific customer environments (as defined by the SOW).
Backup frequency: Daily automated backups, or customized to meet customer SLAs.
Backup storage location: Multi-AZ (Availability Zone) storage within the same geographic region to satisfy data residency requirements.
Backup protection: AES-256 encryption at rest, with access restricted via strict RBAC.
Recovery testing: Restoration tests are performed bi-annually or as specified by customer compliance requirements.
Recovery Time Objective (RTO) / Recovery Point Objective (RPO): Defined strictly per customer contract (Standard baseline: RTO of 4-8 hours, RPO of 1-2 hours for critical managed systems).
Disaster recovery plan: A documented Business Continuity and Disaster Recovery (BCDR) plan exists and is reviewed annually.
9. Sub-processors and Third-Party Providers
Vyturr Tech may rely on third-party providers to deliver hosting, storage, communications, analytics, authentication, security, and other operational capabilities.
Provider | Service or purpose | Processing location |
AWS / Azure / GCP | Primary Cloud Hosting & Infrastructure | As per customer requirement |
Microsoft / Google | Corporate Email & Internal Communication | Global / Regional |
GitHub / GitLab | Source Code Management & CI/CD | Global |
Sub-processor register: Provided to customers upon request during the contracting phase.
Where required by contract or applicable law, we will provide information about relevant sub-processors and notify customers of material changes through the applicable contractual process.
10. Security Monitoring and Incident Response
Security monitoring and incident response help identify, assess, and manage potential security incidents.
Monitoring coverage: Cloud infrastructure, network traffic, access logs, and application performance metrics using cloud-native tools.
Incident response process: A documented Incident Response Plan is actively maintained.
Incident response ownership: Managed by the IT Security & Operations Team.
Notification process: Affected customers are notified via email to their designated administrative and technical contacts within the contractual timeframe (typically 24 to 72 hours of verification).
11. Security Responsibilities
Security is a shared responsibility between Vyturr Tech, its service providers, and, where applicable, its customers. Vyturr Tech is responsible for the security measures applicable to the systems and services it operates, subject to relevant agreements and applicable law. Customers are responsible for protecting their own credentials, defining their specific compliance requirements prior to architecture deployment, and following applicable account security requirements.
12. Continuous Improvement
We review our security practices as our systems, services, risks, and legal obligations evolve. Our security program includes risk assessments, policy reviews, access reviews, vulnerability remediation, and improvements to technical controls.
13. Contact Us
Company: Vyturr Tech Innovations Pvt Ltd
Security Contact: info@vyturr.com
Privacy Contact: info@vyturr.com
Website: https://vyturr.com/
Registered Address: 224 80/3 Vijinapur Village, Krishnarajapuram R S, Bengaluru North 560016, Karnataka
Security documentation requests: Please email info@vyturr.com.
Please do not include passwords, authentication secrets, sensitive personal data, or confidential customer information in an initial security inquiry. We will review inquiries and respond as appropriate.