Security at e-strats
We build, maintain, and support software for clients who trust us with their source code and, where required, access to production systems. This page explains the security practices we use to protect client systems, data, and our own working environment.
Security contact: security@estratcom.com
Access to client systems
Access is limited by role and need. Each engineer has an individual account. We do not use shared logins for access to client systems. Production access is restricted to named personnel, agreed with the client in writing. For most projects, production access is limited to one senior team member.
Multi-factor authentication is required. We use MFA for our cloud consoles, code repositories, email, and other systems that support it. Access to client production environments is protected through VPN and MFA.
Production access is limited to operational needs. Engineers access production environments only when necessary to deploy, monitor, investigate, or resolve issues, and in line with the client’s agreed access arrangements.
Access is removed promptly. When someone leaves a project or e-strats, their access to relevant systems is revoked within one business day. Where required, we confirm the removal of client-system access with the client.
How we handle client data
We do not copy client production data into e-strats systems. Our engineers do not download, export, or store client production data on e-strats devices or corporate systems.
Development and testing use synthetic or masked data. Client production data is not used as a general-purpose development or testing dataset.
Client production data remains in the client’s environment. Most of the systems we develop and support run in cloud accounts owned or controlled by the client, using the region selected by the client.
Our corporate systems use Microsoft Azure infrastructure in the East US region. Client production data is not copied into our corporate environment simply because we provide development or support services.
Secure software development
Security is part of our development and release process. Changes to client software normally follow these controls:
- Work is planned and recorded in a ticket or project management system.
- Engineers develop changes in separate source-control branches rather than working directly on the main branch.
- Code changes are reviewed and approved by a second engineer before they are merged.
- Automated tests and static application security testing (SAST) are used to identify defects and potential security issues in source code.
- Changes are tested in a staging or other non-production environment before release.
- Production releases follow the client’s agreed approval and deployment process.
- Previous builds are retained where needed to support rollback if a release causes a problem.
Passwords, API keys, tokens, and other application secrets are stored in appropriate secrets-management systems rather than being committed to source code.
Our people and devices
Security controls also apply to the people and devices used to deliver our services.
- New employees undergo background checks where permitted by applicable law.
- Employees sign confidentiality and intellectual property agreements before beginning work.
- Staff receive security awareness training during onboarding and at least annually.
- Training covers phishing, password security, MFA, social engineering, and the safe handling of client information.
- Company-managed Windows devices use Microsoft Defender with real-time protection and the Windows firewall enabled.
- Access to client systems is provided according to the person’s role and project responsibilities.
Security incidents
We maintain an incident register and procedures for investigating and responding to suspected security incidents.
If we become aware of an incident that may affect a client’s systems or data, we notify the affected client within the timeframe agreed in our contract. We work with the client to investigate the issue, contain it, support remediation, and document the outcome.
Where e-strats processes personal data on behalf of a client, we support the client in meeting its own incident-response and data-protection obligations as required by our agreement.
Reporting a security vulnerability
If you believe you have found a security vulnerability in our website or in a system operated by e-strats, please contact:
Please include enough information for us to understand and reproduce the issue, including the affected page or system, the steps you followed, and the result you observed.
We aim to acknowledge vulnerability reports within 2 business days and will keep reporters informed as we investigate and address confirmed issues.
When investigating a potential vulnerability, please:
- do not access, copy, change, or delete data that does not belong to you
- do not disrupt or degrade our services or a client’s services
- do not use social engineering, phishing, or physical attacks
- stop testing if you encounter personal, confidential, or client data
- Give us reasonable time to investigate and address the issue before publicly disclosing it
We appreciate responsible reports that help us improve the security of our systems.
Compliance and assurance
Our security practices include controls commonly used in established security and assurance programmes, including access control, MFA, code review, security testing, staff training, endpoint protection, incident management, and controlled production access.
We support client security reviews and audits relating to the systems we develop and maintain. Where appropriate and subject to confidentiality requirements, we can provide additional information about our security controls as part of a client due diligence or procurement process.
Third-party providers
We use third-party providers for certain cloud, communication, development, and business functions. Providers that process relevant client or company data are identified on our Sub-processors page.
Our Privacy Policy explains how e-strats collects, uses, shares, and protects personal data.
Security questions
For security questions, vulnerability reports, or client security reviews, contact:
security@estratcom.com
+92-51-8486782