Security Assessment

Pre-filled security questionnaire.

Save your security team 3–5 days. We've pre-answered the most common enterprise vendor security assessment questions below. Download as PDF or copy sections directly into your VSAQ or SIG Lite.

🏢Organisational Security

Do you have an Information Security policy?

Yes. AravaliStack maintains an Information Security Management System (ISMS) aligned to ISO 27001:2022. Policy is reviewed annually and approved by the Board. Available to customers under NDA.

Do you conduct background checks on employees?

Yes. All full-time employees and contractors undergo police verification, employment history verification, and education credential verification before joining. For engineers with production access, enhanced background checks are conducted.

Do you have a dedicated security function?

Yes. AravaliStack has a dedicated security team led by a CISO with 15+ years experience. The security function is independent of engineering and reports directly to the CEO. We also engage an external CERT-In empanelled security firm for independent assessments.

🔐Data Protection

Does AravaliStack store or process customer data?

AravaliStack runs entirely on the customer's own infrastructure. We do not store, process, or have access to customer data unless the customer explicitly grants support access for a time-limited, logged session. Platform telemetry (metrics, logs) remains within the customer's environment.

Is data encrypted at rest and in transit?

Yes. AravaliStack enforces AES-256 encryption at rest for all persistent data volumes by default. All inter-service communication is encrypted via mTLS enforced by Istio. External API traffic is TLS 1.2 minimum (TLS 1.3 default). Encryption key management is handled by HashiCorp Vault running within the customer's own perimeter.

Do you comply with DPDP Act 2023?

Yes. AravaliStack's on-premise deployment model is inherently DPDP Act compliant — data never leaves the customer's infrastructure. We provide a DPA (Data Processing Agreement) as standard, and our compliance team can produce a DPDP Act readiness assessment on request.

🔄Business Continuity

Do you have a Business Continuity Plan (BCP)?

Yes. AravaliStack maintains a BCP and Disaster Recovery Plan (DRP) tested biannually. RTO for AravaliStack's internal support systems is 4 hours; RPO is 1 hour. BCP documentation available on request under NDA.

What is your incident response process?

AravaliStack maintains a formal Incident Response Plan aligned to NIST CSF and CERT-In guidelines. Incidents are classified P1–P4. P1 triggers immediate escalation to CISO and customer notification within 1 hour. Post-mortem published within 5 business days. Security incidents are notified to CERT-In and affected customers per DPDP Act requirements.

Download complete pre-fill pack

The full pack covers 80+ questions across 12 security domains — formatted for direct import into VSAQ, SIG Lite, and most enterprise vendor risk management platforms.

📄

SIG Lite Pre-fill (XLSX)

Shared Assessments Standard Information Gathering Lite

📋

VSAQ Pre-fill (PDF)

Vendor Security Assessment Questionnaire

🏦

RBI Vendor Due Diligence Pack

Specifically for RBI-regulated financial entities

🏥

Healthcare / IRDAI Vendor Pack

For hospitals and insurance sector

Need a custom security assessment?

Some procurement processes require on-site visits, interviews with our CISO, or custom questionnaire formats. We accommodate all of these.