Security

1. Our approach

9th Direction Technology Solutions Private Limited builds enterprise software, product experiences and applied-AI systems for clients across the US, UK, EU and Australia. Security is a core part of how we deliver that work, not an afterthought. This page summarizes our general practices in plain terms; it is a standard policy template rather than a certification or audit report, and specific engagements may be governed by additional security terms agreed in a client contract or statement of work.

2. How we handle client data and code

• Confidentiality by default. Client code, credentials and business data shared with us for an engagement are treated as confidential and are only accessed by team members actually working on that engagement.
• Least-privilege access. Where a project requires access to a client's systems, we request the narrowest scope of access needed to do the work, and remove that access at the end of the engagement.
• No unnecessary retention. We keep client source code and data only for as long as needed to deliver and support the engagement, plus any period required by our contract or by law.
• Separation of engagements. Work for one client is kept logically separate from work for another; we do not reuse one client's proprietary code or data on another client's project.

3. Infrastructure practices

Our own systems (this website, the quote portal, and internal tooling) follow standard hardening practices for a business of our size:

• Services run in isolated containers, separating the public-facing web layer from the application and database layers;
• All traffic to our site and portal is served over encrypted HTTPS connections;
• Administrative access requires authentication, and sessions expire automatically after a limited period;
• Passwords are never stored in plain text — they are one-way hashed using industry-standard algorithms;
• Operational data is backed up on a regular schedule to a access-controlled cloud storage location;
• Dependencies and base system images are updated on an ongoing basis to incorporate upstream security fixes.

4. Proposal and quote link security

Commercial proposals sent through our quote portal are protected by a layered model designed to keep sensitive pricing and scope information private:

1. Unique access tokens — every proposal link includes a random token; links without a valid, matching token are rejected.
2. Optional PIN protection — for higher-sensitivity proposals, we can add a PIN code that must be entered before the proposal is displayed.
3. Automatic expiry — proposal links expire automatically after a set period and can be extended, rotated or revoked by us at any time, including immediately if a link is thought to have been shared beyond its intended recipient.

If you receive a proposal link, please treat it as confidential and avoid forwarding it outside your organization without letting us know.

5. Application security practices

We follow generally accepted secure-development practices appropriate to the size and risk profile of our systems, including input validation on data accepted from the public internet, scoped API access controls, secrets kept out of source code, and code review before changes reach production. As a small team, we do not currently operate a formal bug bounty program, but we take reports seriously (see Section 6).

6. Responsible disclosure

If you believe you have found a security vulnerability in our website, quote portal, or related systems, we would appreciate the opportunity to investigate and fix it before any public disclosure. Please:

• Email us with a clear description of the issue and steps to reproduce it, ideally with a proof of concept;
• Avoid accessing, modifying or deleting data belonging to others while testing;
• Give us a reasonable amount of time to investigate and remediate before sharing the issue publicly.

7. Incident response

In the event of a confirmed security incident affecting client data, we will investigate promptly, take reasonable steps to contain and remediate the issue, and notify affected clients in line with our contractual and legal obligations.

8. Changes to this policy

We may update this page as our practices evolve; the "Last updated" date above reflects the most recent revision.

---

← Back to home