Security Practices

How we work with you

Scope and price are agreed in writing before work starts.
You keep every configuration, runbook and admin access. Credentials are handed over securely at the end of the project.
Support is during business hours, with first response within 24 business hours.
We do not run a 24x7 security operations centre. Security alerts are reviewed during support hours.

Exact scope, hours and response times are written into your agreement before work starts.

Certifications and compliance

This page describes practices, not certifications. When we mention a framework or standard, such as ISO 27001, we mean we design with it in mind (“aligned with”). We do not mean that we or you are certified or compliant.

Whether your business meets a rule depends on your own controls, processes and audits. If you need a certified provider, ask us directly and we will tell you plainly where we stand.

About this website

It is served only over HTTPS, with HSTS and standard browser security headers.
It is hosted on Cloudflare Pages.
Analytics cookies stay off until you choose “Accept All” in the cookie banner.
The contact and newsletter forms send your message to our inbox through FormSubmit, a third-party form service.

Report a security problem

Email info@jwithkp.com with the page or system affected, what you found and the steps to reproduce it. The same contact is published in our security.txt file.

Please do not access, change or share data that is not yours, and do not disrupt the site or anyone’s service.
Please give us a reasonable time to fix a problem before you share it publicly.
This is not a paid bug-bounty programme, and we do not offer rewards.

Incident reporting in India (CERT-In)

A plain-language summary for non-lawyers. It is not legal advice, and whether the rules apply to your business is for you and your adviser to decide.

What the directions say

CERT-In’s directions of 28 April 2022, issued under section 70B(6) of the IT Act, 2000, apply to service providers, intermediaries, data centres, body corporate and government organisations.
Listed cyber incidents must be reported to CERT-In within 6 hours of noticing them or being told about them. The list includes unauthorised access, ransomware and other malicious code, data breaches and leaks, phishing and denial-of-service attacks.
Reports go to incident@cert-in.org.in or 1800-11-4949.
Logs of ICT systems must be kept securely for a rolling 180 days within India, and given to CERT-In with an incident report or when it asks.
System clocks must be synchronised with the NIC or NPL time servers, or sources traceable to them.
A point of contact must be designated for CERT-In.

Source: CERT-In directions, 28 April 2022 (PDF). Check cert-in.org.in for the current version.

Separately, the DPDP Rules, 2025 (rule 7) will require a business that holds personal data to tell each affected person and the Data Protection Board about a personal data breach without delay, with fuller details to the Board within 72 hours. That part of the Rules starts to apply eighteen months after their publication on 13 November 2025.

What monitoring can and cannot do

Logging and monitoring tools such as Wazuh give you visibility. They can collect and keep logs and alert you to unusual activity, which supports noticing an incident and gathering the records a report needs. Whether logs are kept for 180 days inside India depends on how the system is set up and where it is hosted, which we would agree with you in writing.

Monitoring does not make a business compliant, and we do not file reports for you. Our monitoring is not 24x7: alerts are reviewed during support hours, so we cannot promise that an incident will be noticed, or reported, within 6 hours. If you need round-the-clock cover, ask us what we can and cannot do.

Questions to ask any IT provider

Use these with us and with anyone else you are thinking of hiring. A good provider will answer them plainly.

Who will have access to our systems, and how is that access protected?Look for named accounts and multi-factor authentication, not shared logins.
Where do you keep our passwords and recovery details, and who can see them?The answer should be a password manager, not chat, email or a spreadsheet.
What happens to our access and our data when the contract ends?You should keep your configuration and admin access, and anything the provider held should be handed over or removed.
Do you work from encrypted, up-to-date devices?A lost laptop should not mean a lost client.
How will you tell us if something goes wrong, and how soon?Ask for a named contact and what “soon” means in practice.
Which certifications do you hold, if any, and what exactly do they cover?Ask for the certificate and its scope, not a badge on a web page.
Who else will see our data: subcontractors, tools, partners?Every extra party is another place your data can leak from.
Are scope and price agreed in writing before work starts?Unclear scope is where most disputes begin.

How we handle security