Security and compliance

This page describes how HMR Infotech protects its own systems and the systems we build for clients. It is a summary. Our security pack, shared under NDA, has the detail your security team will ask for.

Certifications

HMR Infotech does not currently hold a third-party security certification such as ISO/IEC 27001 or a SOC 2 report. When we gain one, we will list it here with its scope and expiry date. Until then, each client contract sets out the security commitments that apply to that engagement.

Zero trust by default

• Every person and every service signs in with its own identity. There are no shared accounts.
• Multi-factor authentication is required on all HMR systems, including email and source code.
• Access is granted per engagement and per role, reviewed at the end of each engagement, and removed the day someone leaves.
• Engineers use administrative rights only when a task needs them, for the time it needs them.

How we handle client data

• We work inside the client's own environments and tools wherever we can, so client data stays where the client controls it.
• We do not copy production data into development or test environments without the client's written approval, and we mask personal data when we do.
• Client data is never used to train AI models, ours or a provider's.
• At the end of an engagement we return or delete client data as the contract requires, and confirm it in writing.

Secure development

• All code goes through peer review before it is merged. No one approves their own change.
• Dependencies are scanned for known vulnerabilities on every build, and secrets are kept out of source code.
• Infrastructure is defined as code, so every change is reviewed and can be traced.
• For AI agents we build, every action is logged, and any step that carries risk waits for a named person to approve it. See our AI governance policy.

Incidents

If we suspect a security incident affecting a client, we tell the client's named contact without undue delay and in time for them to meet their own reporting duties, including CERT-In's six-hour reporting window in India. We then share what happened, what data was affected and what we have done.

Report a vulnerability

Email security@hmrinfotech.com. We acknowledge reports within two business days and never take action against good-faith research. Our security.txt has the same details.