Our Information Security Approach

1. Purpose and Scope

This page summarizes the information security approach applied to the delivery of Respongo products and services. Commitments made under a specific customer contract are defined in the applicable contract and its annexes.

2. Certification and Audit

The standards applied at the product and infrastructure layers (such as ISO 27001 and SOC 2 Type II), and whether they belong to Respongo or to an infrastructure/business partner provider, are shared in writing upon request.

Audit reports may be shared with our enterprise customers and prospects, subject to the signing of a confidentiality agreement.

Respongo does not make any certification or compliance claims that cannot be verified.

3. Security Principles

• Access management: role-based authorization, least privilege principle, and multi-factor authentication
• Encryption: industry-standard encryption in transit and at rest
• Monitoring and logging: retention of system and access logs, anomaly monitoring
• Backup: regular backups and restore testing
• Segregation: logical separation of customer data

4. Security Testing

Periodic vulnerability scans and independent penetration tests (VAPT) are conducted at the application and infrastructure layers. Identified findings are prioritized by severity and remediated within defined timelines.

5. Incident Management

A defined incident response process is operated for the detection, classification, response to, and reporting of security incidents. In the event of a personal data breach, the notification obligations required by applicable law are fulfilled.

6. Business Continuity

Redundancy, disaster recovery, and business continuity plans are defined to ensure service continuity. Recovery time objective (RTO) and recovery point objective (RPO) values are specified in the service level commitments.

7. Subprocessors

Hosting and infrastructure providers involved in the delivery of the service are engaged under contractual security and data protection obligations. The current subprocessor list is shared upon request.

8. Security Disclosure

If you believe you have identified a security vulnerability, please notify us through our contact channels. We review reports and respond within the framework of responsible disclosure principles.

Last updated: July 1, 2026 · For questions, please use our contact page.