Legal centre / Security
Security
The measures protecting our systems and our customers' data, the incident-reporting clocks Indian law puts on us, an honest statement of what we are and are not certified for, and how to report a vulnerability.
Drafted against
- Digital Personal Data Protection Act, 2023 — sections 8(5) and 8(6)
- Information Technology Act, 2000 — section 43A
- Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011
- CERT-In Directions No. 20(3)/2022-CERT-In dated 28 April 2022
Certifications: where we actually stand
Mallah Software Services Private Limited was incorporated on 5 September 2026. We hold no third-party security certification, and we are not going to imply otherwise — a SOC 2 Type II report alone needs an observation window we have not had the calendar to complete.
| Framework | Our position | Status |
|---|---|---|
| ISO/IEC 27001:2022 | Our controls are built to the Annex A model — the same control library Regulane ships with | Not certified |
| SOC 2 | The trust services criteria inform how we log, restrict and review access | No report obtained |
| Independent penetration test | Planned. When one has been carried out, this page will name who did it and when | Not yet commissioned |
| DPDP Act, 2023 | We operate as a Data Fiduciary for our own processing and a Data Processor for customer workspaces, under written terms | In force — no certification exists to hold |
| HIPAA | Not supported. We will not sign a BAA until the controls behind it are in place and verified | Not offered |
Tell us. We will be straight with you about our timeline rather than sell you a certificate we do not have, and we would rather lose a deal on that basis than win one on a false statement.
The measures we do take
- Encryption. TLS on everything in transit; encryption at rest on databases, object storage and backups.
- Tenant isolation. Every record is scoped to a workspace and the scope is checked on each request, not assumed from a session.
- Access control. Role-based access, least privilege, and separate credentials per environment. Production access is limited to those who need it and is logged.
- Documents. Held in private storage and served through short-lived signed links. Each read is recorded.
- Audit trails. Append-only. Nothing in the application edits or deletes an audit row, which is the only reason such a trail is worth anything to an auditor.
- Backups. Taken daily, encrypted, and restore-tested — a backup nobody has restored is a hope, not a control.
- Dependencies. Scanned for known vulnerabilities and for hardcoded secrets. We use our own CertNotify scanners on our own code, which is a reasonable test of whether we believe in them.
- Hosting. Primary region in India. Server logs are retained 180 days, as the CERT-In Directions of 28 April 2022 require.
Incident reporting, and the clocks on us
These are statutory obligations, not aspirations.
| Event | Who we tell | Within |
|---|---|---|
| A reportable cyber security incident | CERT-In, at incident@cert-in.org.in | 6 hours of noticing it — Directions of 28 April 2022 |
| A personal data breach | The Data Protection Board of India, and every affected Data Principal | Without delay, in the manner section 8(6) of the DPDP Act prescribes |
| A breach affecting a customer’s workspace data | That customer, so it can meet its own obligations as Data Fiduciary | Without undue delay |
| Information lawfully required by an authorised agency | The requesting agency | 72 hours — rule 3(1)(j), IT Rules 2021 |
What you will get from us is what happened, what data was involved, what we have done and what you should do. Not a reassurance email with no facts in it.
Reporting a vulnerability
Email contact@mallahsoftware.com with the subject line starting SECURITY. Tell us what you found, how to reproduce it, and how you would like to be credited.
What we commit to: an acknowledgement within 24 hours, an assessment within 3 working days, and we will tell you when it is fixed. We will not threaten you or send a lawyer at you for a good-faith report. We do not currently pay a bounty, and we would rather say so than let you assume one exists.
Please do not run automated scanners against production, do not test denial of service, and do not access, alter or retain anyone else’s data. If you need an environment to test against, ask and we will arrange one.
Data you can take with you
Registers, reports and evidence export to PDF and CSV whenever you want them, not only on the way out. Records are scoped per customer and checked on each request, and destruction of a document requires approval from someone other than the person who requested it. None of that is impressive on a slide; it is what an auditor asks for.