Trust & Security
Your code, data and ideas are protected at every step, from the first NDA to launch and long-term support.
Our Approach
When you share source code, customer data or a new product idea with a technology partner, you need to know it's safe. At EIT Connect, security isn't a step at the end of a project. It's built into how we hire, how we access systems, how we write and test code, and how we hand over and close projects. Threats change constantly, so we review our practices regularly and keep our team trained to spot and stop risks early.
Our Safeguards
We sign NDAs before sensitive details are shared, and every employee and contractor is bound by confidentiality and intellectual property clauses.
Team members get only the access their role needs, with multi-factor authentication on key systems. Access is reviewed regularly and removed when a project ends or someone leaves.
We follow OWASP secure coding guidance, review code before it's merged and use automated checks to catch vulnerabilities and outdated libraries. See our DevSecOps practice.
Development, testing and production are kept apart. We use test or masked data in development wherever possible, rather than real customer data.
Data is encrypted in transit using TLS, and sensitive data is encrypted at rest. Passwords, keys and credentials are stored in a secure vault, never in code or chat.
Company devices use disk encryption, endpoint protection and automatic updates. Office networks are protected by firewalls, with guest access kept separate.
Our offices use controlled entry and visitor management, with work devices locked when unattended.
Internal systems and project repositories are backed up securely, and restores are tested so we can recover quickly if something goes wrong.
Every team member completes security and privacy training, including phishing awareness and safe handling of client data, when they join and regularly after.
End to End
NDA signed, data handling agreed and named contacts set on both sides.
Access granted only to the people working on your project, with multi-factor authentication.
Secure coding, code reviews and automated checks on every change.
Functional, performance and security testing before release, with a website security audit available for higher-risk projects.
Controlled deployments with logging and rollback.
Updates, monitoring and patching under your maintenance plan.
Code, documentation and credentials handed over; our access removed and your data returned or deleted as agreed.
Regulations
We help clients build software designed to meet the rules that apply to them. Compliance itself depends on how each client operates the system, so we work alongside your legal and compliance teams.
Consent capture, notices, data access and deletion requests, retention rules and audit logs built into your product
Logging, log retention and incident processes that help you meet reporting duties
Privacy-by-design features, data minimisation and data subject request handling for EU users
Access controls, audit trails and encryption for US healthcare products. There is no official HIPAA certification for software; compliance is the client's responsibility
Payment flows that use tokenised, PCI-compliant payment gateways so card data never touches your servers
If Something Goes Wrong
If we detect a security incident affecting your project or data, we contain it, investigate the cause, and tell you promptly with clear facts and next steps. We keep logs as required under India's CERT-In directions and support you with any reporting your organisation must make, including under the DPDP Act.
Report a Vulnerability
If you believe you've found a vulnerability in EIT Connect's systems or website, please email [info@eitconnect.com] with the details. Please don't access or change data, and give us reasonable time to fix the issue before sharing it publicly.
Yes. We sign an NDA before you share sensitive information, and everyone who works on your project is bound by confidentiality and intellectual property obligations.
Only the people assigned to your project, with access limited to what their role needs and protected by multi-factor authentication. Access is removed when the project ends or someone leaves.
Not by default. We use test or masked data in development and testing wherever possible. If real data is needed, we agree how it will be handled and protected first.
You do, once agreed payments are complete. We hand over the source code, documentation and credentials, and remove our access at the end of the engagement.
Yes. We regularly answer client security and vendor questionnaires and can share a security overview to speed up your review.
We build the technical features the Act requires, such as consent capture, notices, access and deletion requests, retention rules and audit logs. Your legal team should confirm how the Act applies to your business.
We hand everything over, remove our access, and return or delete project data as agreed in your contract, keeping only what the law requires.
Talk to us about your security requirements before your project starts.
