Certification & Security Assessments
Our Security & Compliance Credentials
Our ISO/IEC 27001:2022 certification and independent external security assessments demonstrate our commitment to information security.
CERTIFIED
ISO/IEC 27001:2022
ASPIA Infotech Private Limited maintains an Information Security Management System (ISMS) certified against ISO/IEC 27001:2022.
CERTIFICATION SCOPE
Design, Development, Implementation, Hosting and Support of ASPIA Cybersecurity Governance Solutions and Associated Cybersecurity Services.
Standard
ISO/IEC 27001:2022
Certification Number
C76AC29A
Status
Active
Our certified ISMS supports a structured approach to managing information security risks and protecting information assets.
SECURITY ASSESSMENT
Vulnerability Assessment & Penetration Testing
Security testing is an integral part of ASPIA's application security practices, helping identify and address potential security weaknesses.
- Internal Security Testing: Vulnerability assessment and security testing conducted by ASPIA's technical team.
- External VAPT: Independent security assessment conducted through a CERT-In empanelled service provider.
- Finding Evaluation: Identification, evaluation and prioritisation of security findings.
- Remediation: Tracking and addressing identified vulnerabilities through appropriate corrective actions.
Detailed VAPT reports, assessment dates and technical findings are confidential security information. Relevant documentation may be shared with eligible customers, subject to applicable confidentiality requirements.
Our Security Approach
Structured Security Across the Platform
ASPIA supports both cloud-hosted and customer-hosted on-premises deployment models, with controls applied across infrastructure, data, access, application, monitoring and resilience.
01
Infrastructure & Network Security
- AWS cloud infrastructure for the hosted deployment.
- Network segmentation and environment isolation.
- Firewall and network access restrictions.
- Cloudflare security and Zero Trust access controls.
- DDoS protection mechanisms.
- Infrastructure security monitoring.
- Secure administrative and remote access.
02
Data Protection & Encryption
- TLS 1.2 or higher for supported encrypted communications.
- Secure communication channels.
- Controlled access to customer information.
- Data protection and handling procedures.
- Backup and recovery practices.
- Appropriate information retention and disposal procedures.
03
Identity & Access Management
- Multi-factor authentication (MFA).
- Role-based access control.
- Least-privilege access principles.
- Restricted administrative access.
- User access reviews.
- Controlled user provisioning and de-provisioning.
04
Application Security & Vulnerability Management
- Internal application security testing.
- External vulnerability assessment and penetration testing.
- Dependency and third-party component reviews.
- Vulnerability identification and remediation.
- Security updates and patch management.
- Secure application configuration and deployment practices.
05
Security Monitoring & Incident Response
- Infrastructure and security event monitoring.
- Centralised security logging where configured.
- Security event identification and escalation.
- Documented incident response procedures.
- Incident investigation and remediation.
- Security incident documentation and review.
06
Business Continuity & Disaster Recovery
- Database backup procedures.
- Backup and restoration processes.
- Disaster recovery arrangements.
- Infrastructure recovery planning.
- Periodic review of recovery procedures.
Applicable recovery arrangements depend on the deployment model and contractual requirements.
Deployment Security
Two Deployment Models, One Security Standard
ASPIA supports cloud-hosted and customer-hosted deployment models to accommodate different organisational, infrastructure and security requirements.
Cloud-Hosted Deployment
ASPIA's hosted production environment runs on AWS cloud infrastructure, supported by Cloudflare security and access protection controls.
Security Controls
- AWS-hosted production infrastructure
- Network segmentation and firewall controls
- Infrastructure security monitoring and audit logging
- Controlled administrative access with MFA
Customer-Hosted On-Premises Deployment
Organisations can deploy ASPIA within their own data centre or designated hosting environment, based on their infrastructure and security requirements.
Security Controls
- Customer-controlled infrastructure and hosting environment
- Deployment-specific network security and firewall controls
- Role-based access controls and authentication mechanisms
- Customer-defined infrastructure and security policies
Shared Security Responsibility: Security responsibilities may vary depending on the selected deployment model, agreed architecture and customer-managed infrastructure.
Privacy & Data Protection
Responsible Handling of Information
ASPIA recognises the importance of protecting personal and customer information.
Our privacy practices address the responsible collection, processing, storage, access, retention and disposal of information in accordance with applicable requirements.
For additional information, please refer to our Privacy Policy.
Security Documentation
Information for Enterprise Customers
Enterprise customers and prospective customers may contact ASPIA for relevant security, privacy and compliance documentation to support vendor due diligence, procurement and security assessments.
Available documentation, subject to availability, approval and confidentiality requirements, may include:
01. ISO/IEC 27001:2022 Certificate
02. Information Security Policy
03. Network Security Policy
04. Access Control & Authentication Policy
05. Vulnerability Management & VAPT Documentation
06. Incident Response Policy
07. Business Continuity & Disaster Recovery Documentation
08. Privacy Policy & Data Processing Agreement
Sensitive technical reports, internal policies and detailed security configurations are not published publicly and may be shared with eligible customers subject to approval and confidentiality requirements.
FAQ
Frequently Asked Questions
Is ASPIA ISO 27001 certified? +
Yes. ASPIA Infotech Private Limited is certified against ISO/IEC 27001:2022 for its Information Security Management System. The certificate number is C76AC29A.
Does ASPIA conduct VAPT? +
ASPIA conducts internal security testing through its technical team and external VAPT through a CERT-In empanelled service provider. Identified findings are evaluated and addressed through remediation activities.
Can customers obtain ASPIA's VAPT report? +
Detailed VAPT reports contain sensitive technical information and are not publicly available. Eligible customers can contact ASPIA to discuss appropriate security documentation, subject to confidentiality requirements.
How does ASPIA protect data in transit? +
ASPIA supports TLS 1.2 or higher for encrypted communications. The public-facing website also currently has an A+ rating in SSL Labs testing.
Does ASPIA support Multi-Factor Authentication? +
Yes. Multi-factor authentication is part of ASPIA's access security practices.
Where is ASPIA hosted? +
ASPIA supports AWS-hosted cloud deployment as well as customer-hosted on-premises deployment. The selected model depends on the customer's requirements and agreed deployment architecture.
Does ASPIA support on-premises deployment? +
Yes. ASPIA supports customer-hosted on-premises deployment in addition to its cloud-hosted offering.
Does ASPIA have a business continuity and disaster recovery process? +
Yes. ASPIA maintains documented backup and disaster recovery arrangements to support service continuity and data recovery. Specific arrangements depend on the deployment model and applicable infrastructure responsibilities. Recovery objectives may be defined as part of the applicable customer deployment and service arrangements.
How does ASPIA manage security incidents? +
ASPIA follows documented incident response procedures covering incident identification, assessment, response, remediation and appropriate communication with relevant stakeholders. Incidents are handled according to their nature, impact and applicable response procedures.
How can I contact ASPIA regarding security concerns? +
For security enquiries, vendor due diligence, compliance documentation or responsible vulnerability disclosure, please contact our security team at security@aspiainfotech.com.
SECURITY & TRUST
Let's Talk Security.
Have questions about ASPIA's security practices, ISO 27001 certification or enterprise security requirements? Our team is here to help.
Certifications & Reviews
Platform
Solutions
Industries
Enterprise Governance, Risk & Security Operations Platform
ASPIA is an Enterprise Governance, Risk & Security Operations Platform that helps organizations execute governance programs through accountable workflows, remediation tracking, and executive visibility.
Manage Cookie Preferences
Functional
Always active
Essential cookies required for website functionality and security.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
Cookies used to understand website usage and improve performance.
The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
Cookies used for advertising and tracking, where applicable.