Security & Responsible Disclosure

1. How we handle client data

• Where data residency matters, we deploy models and data pipelines inside the client's own infrastructure — on-premise or in the client's private cloud tenant.
• Client data is used only for that client's project. It is not used to train models for anyone else, and it is not sent to third-party AI providers unless the client agrees in writing.
• We sign a non-disclosure agreement — and, where personal data is involved, a data processing agreement — before any data is exchanged.
• Access follows the principle of least privilege: only the people working on an engagement can reach its systems, using individual accounts with multi-factor authentication.
• At the end of an engagement, client data held in our environments is returned or deleted as set out in the contract.

2. Secure development

• Every change is code-reviewed before it is merged.
• Automated tests, dependency checks and static security analysis (SAST) run in continuous integration.
• Secrets are kept in dedicated secret stores, never in source code.
• Development, staging and production environments are kept separate.

3. This website

• Served over HTTPS only.
• Collects the minimum personal data needed — see our Privacy Policy.
• The contact form is protected by Cloudflare Turnstile, and every submission is verified on the server.
• No advertising trackers; analytics are cookieless.

4. Certifications and frameworks

We design systems to help clients meet their obligations under frameworks such as the GDPR, HIPAA and SOC 2. We do not claim certifications or audit reports we have not obtained; any that we receive will be listed on this page.

5. Reporting a vulnerability

If you believe you have found a security issue in naringhi.dev or in a system we operate, email hello@naringhi.dev with the subject “Security report” and include:

• a description of the issue and its potential impact;
• the steps, or a proof of concept, needed to reproduce it;
• the URLs or components affected.

We aim to acknowledge reports within 3 business days and to keep you informed until the issue is resolved. Our security contact is also published in security.txt.

While investigating, please:

• do not access, modify or delete data that does not belong to you;
• do not run denial-of-service, spam or social-engineering tests;
• give us reasonable time to fix the issue before disclosing it publicly.

We will not take legal action against researchers who act in good faith and follow these guidelines.