Security
- Last updated
- 1 August 2026
This document is a working template and has not yet been reviewed by counsel. It describes our intended practice; it is not yet a binding policy. Contact us for the executed version before relying on it.
Reporting a vulnerability
Send it to the security address below. We acknowledge within 24 hours, give you an assessment within five business days, and tell you when it is fixed. We will not pursue legal action against researchers acting in good faith, and we will credit you unless you would rather we did not.
Scope
This site, our product deployments, and our public infrastructure. Please do not test client deployments — they are not ours to authorise testing against, and we will put you in touch with the client instead.
How we build
Least privilege by default, infrastructure defined in code and reviewed, secrets in a managed store rather than in environment files, dependency and container scanning in CI, and mandatory review on every change to production.
Client data
We prefer deployments where we never hold client data at all. Where an engagement requires it, data is encrypted in transit and at rest, access is role-scoped and logged, and the retention period is set in the engagement agreement rather than by us.
Incidents
Affected clients are notified within 24 hours of confirmation, with what we know at that point rather than a polished summary later. A written post-incident review follows within ten business days and goes to the client whether or not they ask for it.
Attatva Systems Pvt. Ltd.
M8RG+RH8, Anamnagar, Kathmandu 44600, Nepal
attatvasystems@gmail.com