Security
ISO 27001:2022 certification
Dhwani RIS is certified to ISO/IEC 27001:2022 for Information Security Management Systems (ISMS). This certification covers the design, development, and delivery of software for the social-sector impact space.
- Certifying body: TRIF
- Certificate number: IS1140148192026
- Scope: Development, deployment, operation, and support of digital platforms and IT solutions for data management, monitoring, analytics, and reporting for non-profits, foundations, CSR initiatives, and government bodies, including all related information assets, infrastructure, personnel, and third-party services.
- Valid until: 29 January 2029
Security practices
Our information security programme includes:
- Annual risk assessments and internal audits against ISO 27001 controls
- Encryption of data in transit (TLS 1.2+) and at rest for sensitive personal data
- Role-based access controls and the principle of least privilege
- Regular security patching and dependency updates
- Employee security awareness training
- Incident response and business continuity planning
- Third-party penetration testing (twice a year)
Responsible disclosure
We take security reports seriously. If you believe you have found a security vulnerability in our systems or website, please disclose it responsibly:
- Email: security@dhwaniris.com
- Machine-readable disclosure policy:
/.well-known/security.txt
Please include a description of the issue, steps to reproduce it, and its potential impact. We will acknowledge your report within 5 business days and aim to resolve confirmed issues within 30 days.
We request that you do not publicly disclose a vulnerability before we have had reasonable time to address it, and that you do not access or modify user data as part of your research.
Data protection
For information about how we protect personal data, including our compliance with India's Digital Personal Data Protection Act 2023, see our Privacy Policy.
Contact
Security concerns: security@dhwaniris.com