Enterprise Security & Data Protection

1. Security Overview

Squinal Private Limited ("Squinal") engineers mission-critical custom business systems, clinical software solutions, SaaS applications, and enterprise digital infrastructures. We recognize that our clients entrust us with proprietary business workflows, confidential operational data, and sensitive patient/customer records.

We maintain a comprehensive Information Security Management System (ISMS) modeled after ISO/IEC 27001 standards, NIST Cybersecurity Framework, and OWASP Top 10 secure software development principles.

2. Data Protection & Cryptography

We enforce modern cryptographic standards across all layers of our software solutions:

• Data in Transit: All data transmitted between client browsers, mobile applications, and backend servers is encrypted using modern TLS 1.3 (or minimum TLS 1.2) with strict HSTS (HTTP Strict Transport Security) enabled and forward secrecy cipher suites.
• Data at Rest: Customer database records, disk volumes, object stores, and backups are encrypted at rest using industry-standard AES-256 encryption.
• Key Management: Encryption keys are stored and rotated through automated cloud Key Management Services (AWS KMS / Azure Key Vault / GCP Cloud KMS) with hardware security module (HSM) backing.
• Separation of Tenancy: Multi-tenant SaaS products utilize strict logical database tenant isolation to ensure zero cross-customer data leakage.

3. Cloud & Infrastructure Security

Our server architectures and client deployment environments reside in Tier-III and Tier-IV data center facilities provided by world-class cloud platforms (AWS, Google Cloud, Microsoft Azure) featuring:

• DDoS Protection: Continuous volumetric mitigation via Cloudflare and enterprise edge load balancers.
• Virtual Private Clouds (VPC): Database clusters and internal microservices run exclusively within isolated private subnets with no public internet ingress.
• Web Application Firewall (WAF): Edge inspection rules block SQL injection, cross-site scripting (XSS), bad bots, and zero-day exploit payloads.
• Automated Redundant Backups: Immutable, multi-region daily snapshots with automated integrity verification and disaster recovery RPO < 1 hour / RTO < 4 hours.

4. Secure Software Development Lifecycle (SSDLC)

Every software release follows a rigorous DevSecOps lifecycle:

• Static & Dynamic Analysis (SAST/DAST): Automated code scanning detects vulnerabilities, dependency risks, and credential leaks prior to production merging.
• Peer Code Reviews: Mandatory dual-engineer reviews for all pull requests modifying authentication, data models, or core API routes.
• Sanitization & Parameterization: Prepared statements and parameterized queries prevent SQL injection across all database engines.
• Third-Party Dependency Auditing: Automated SBOM (Software Bill of Materials) vulnerability monitoring with real-time patch alerts.

5. Identity, Access & Employee Controls

• Role-Based Access Control (RBAC): Granular permissions ensure employees and engineers access only resources strictly required for their operational role.
• Mandatory Multi-Factor Authentication (MFA): Hardware security keys or authenticator apps are enforced for all corporate accounts, code repositories, and production consoles.
• Background Checks & NDAs: All Squinal personnel undergo thorough background verification and execute legally binding non-disclosure agreements prior to onboarding.
• Continuous Security Training: Mandatory bi-annual security awareness training on social engineering, phishing defense, and secure coding practices.

6. Security Incident Response

Squinal maintains a 24/7 dedicated Security Incident Response Team (SIRT). In the event of a verified security incident affecting client data:

• Affected clients and administrators will be notified without undue delay, and in all cases within 72 hours of confirmation in accordance with applicable data protection regulations.
• Comprehensive forensic analysis and mitigation logs will be documented and provided to impacted parties.

7. Vulnerability Disclosure & Bug Bounty

We welcome security researchers to inspect our public endpoints and software responsibly. If you discover a potential vulnerability in any Squinal product or domain, please report it immediately to our security desk: