Security Policy

Security is built into how Techforce Global designs, builds, and operates software and cloud infrastructure. This policy describes the practices and controls we apply to protect the confidentiality, integrity, and availability of the systems and data our clients trust us with.

Overview

We provide cloud engineering, AI, and data intelligence services, which means we regularly work inside client environments and with sensitive business data. Our security program is designed around a simple principle: least access, strong defaults, and clear accountability. This policy applies to our own systems as well as the standards we follow when delivering client engagements.

Security is a shared responsibility. Where we operate within a client’s AWS account or platform, controls are aligned with that client’s policies and the AWS Well-Architected security pillar.

This website and the services described in this Security Policy are owned and operated by Techforce Infotech Pvt. Ltd. ("Techforce", "we", "us", or "our"), a company duly registered under the laws of India.

Data Protection

We collect and retain only the data needed to deliver a service, and we keep it no longer than necessary. Client data is treated as confidential and is never sold or shared for marketing purposes.

• Production and client data are logically separated from internal and test environments.
• Access to client data is limited to team members actively working on that engagement.
• On project completion or request, data we hold is returned or securely deleted in line with the agreement in place.

Encryption

Data is encrypted in transit using TLS, and data at rest is encrypted using industry-standard algorithms such as AES-256 wherever the underlying platform supports it. For AWS workloads we use managed encryption and key services (for example KMS) rather than handling keys manually.

Secrets, credentials, and API keys are stored in dedicated secret managers, never in source code, configuration files, or chat.

Infrastructure Security

Our cloud infrastructure is provisioned through Infrastructure as Code so that configuration is reviewable, repeatable, and auditable. We favour private networking, security groups scoped to need, and hardened baseline images.

• Network access is restricted by default; public exposure is the exception, not the rule.
• Environments are separated so a change in one cannot unintentionally affect another.
• Configuration changes flow through version control and review before release.

Access Control

Access follows the principle of least privilege. Team members receive only the permissions required for their role, and access is reviewed and revoked promptly when it is no longer needed.

• Multi-factor authentication is required on accounts that can reach sensitive systems.
• Individual accounts are used for accountability; shared logins are avoided.
• Administrative actions are logged and attributable to a specific person.

Secure Development

Security is considered throughout our development lifecycle, not bolted on at the end. Code is peer reviewed before it reaches production, and we apply secure coding practices to guard against common risks such as injection, broken access control, and exposure of sensitive data.

Dependencies are kept current, and known-vulnerable packages are updated as part of routine maintenance.

Monitoring & Incident Response

We monitor systems and logs for unusual activity and maintain an incident response process so that any suspected security event is triaged, contained, and resolved quickly.

If an incident affects data we hold on your behalf, we will notify affected clients without undue delay, share what we know, and work with you on remediation and any notifications required by law.

Vulnerability Management

We patch and update systems on a regular cadence and prioritise fixes based on severity and exposure. Higher-risk issues are addressed on an expedited basis rather than waiting for a routine cycle.

Third-Party & Sub-Processors

We rely on reputable service providers, such as AWS, for infrastructure and tooling. We choose vendors that maintain strong security practices, and we limit the data shared with them to what each service genuinely requires.

We do not disclose client data to third parties except as needed to deliver the agreed service, or where required by law.

Business Continuity

Important systems and data are backed up, and recovery procedures are in place so that operations can be restored after a disruption. Backups follow the same encryption and access standards as production data.

Responsible Disclosure

We welcome reports from security researchers and users. If you believe you have found a vulnerability in a system operated by Techforce Global, please contact us privately and give us a reasonable opportunity to investigate and remediate before any public disclosure.

Please do not access, modify, or delete data that is not yours, and avoid actions that could degrade service for others while testing.

How to Contact Us

For any question about this Security Policy, or to report a security concern, please email us at [email protected], or reach out through our contact page.