DGo Digital is a small business. This page describes the security measures actually in place today. It is for information; commitments for client work are set out in the signed agreement and our Data Processing Agreement. We do not hold SOC 2, ISO 27001 or any other certification, and we do not claim to.
1. How the website is protected
- Served only over HTTPS, with HSTS and security headers (a strict Content Security Policy, no framing by other sites, no MIME sniffing).
- Hosted on Cloudflare, with its network protections, bot checks and rate limits on our form endpoints.
- Every form has a hidden spam trap, an origin check and Cloudflare Turnstile, verified on the server.
- No analytics tool loads before you give consent; Google Analytics loads through Cloudflare Zaraz, which limits what Google receives. We use no advertising tools.
- We design our logs not to record names, emails or messages, or provider error details that could contain an email address.
2. How data is handled
- Personal data is kept only in the services listed on our Subprocessors page.
- Access is limited to the people at DGo Digital who need it for the work. Every account that holds data uses two-factor sign-in.
- API keys and secrets are stored as encrypted secrets in our hosting platform, never in code.
- For client work we ask for read-only access, never passwords, and we remove our access when the work ends.
3. When something goes wrong
If we learn of a security incident that affects personal data, we contain it, assess it, and tell the people and clients affected without undue delay, and the authorities where the law requires: for example within 72 hours under GDPR where it applies; to India's CERT-In within 6 hours where its Directions apply; and to the Data Protection Board of India and each affected person under the DPDP Rules once they apply.
4. Reporting a vulnerability
If you find a security weakness in a DGo Digital system, email [email protected] with what you found and how to reproduce it. Our contact details are also in /.well-known/security.txt.
- We acknowledge reports within 3 business days.
- Please do not access or change data that is not yours, disrupt the service, or run automated scans that load our systems.
- Act in good faith and give us reasonable time to fix the issue before telling anyone else. We will not take legal action against good-faith research that follows these rules.
- We do not run a paid bug bounty.
5. Questions
Security questions from clients or prospects: [email protected].