Security at Verdeshell

Verdeshell is an engineering company, and we treat security as an engineering discipline: minimise what we collect, encrypt what we transmit, restrict who can access what, and design systems so that failures are contained and recoverable. This page describes the security posture of Verdeshell and this website; each of our product platforms additionally documents its own security characteristics.

All traffic to verdeshell.com is served over HTTPS (TLS), with HTTP requests redirected to encrypted connections.

The site sends hardened HTTP security headers, including a Content-Security-Policy that restricts where scripts can load from.

Contact and newsletter endpoints are rate-limited to resist abuse, and inputs are schema-validated on the server before processing.

Deployments are atomic with automated health checks and rollback — a failed release is automatically replaced by the last known-good version.

Analytics are self-hosted and privacy-focused (no cookies, no cross-site tracking, aggregate data only).

We collect the minimum personal data needed to respond to you (see our Privacy Policy for the full list). Enquiry data is stored on access-restricted infrastructure and transmitted only over encrypted connections.

Transactional email is delivered through Microsoft as our email provider; credentials and server secrets are kept out of the codebase and deployment bundles, and live only on the production server with restricted access.

Production and development environments are separated, with production configuration injected at deploy time rather than stored in the repository.

Changes go through automated checks (type safety, linting, tests — including tests that guard the accuracy of claims on this site) before release.

Dependencies are kept current and the platform runs on actively supported runtime versions.

Our SaaS products (Recruit, Career, HRMS, CRM, Inventory, Flow, and EchoIQ by Pleisys) run as separate platforms with role-based access control and encrypted transport. Product-specific security details — such as encryption standards and data handling for each application — are documented on each product page and platform.

We are transparent about where we are: Verdeshell does not currently hold ISO 27001 or SOC 2 certification. We align our practices with the intent of those frameworks and with applicable data-protection law, including India’s Digital Personal Data Protection Act and GDPR principles for personal data we process.

For our clients, we support compliance-driven engagements — including GDPR-aligned data handling and SOC 2 preparation support as a service — and we are happy to complete security questionnaires as part of your procurement process.

If you believe you have found a security vulnerability in this website or any Verdeshell platform, please report it to connect@verdeshell.com with enough detail to reproduce the issue. We will acknowledge your report, investigate promptly, and keep you informed. We ask that you avoid accessing other users' data and give us reasonable time to remediate before public disclosure.

For security questionnaires, due-diligence requests, or anything else on this page, contact connect@verdeshell.com.