IT Security

Valorega is committed to protecting its employees, partners, clients and the company itself from damaging acts either malicious or unintentional. This includes the implementation of policies, standards, controls and procedures to ensure the Confidentiality, Integrity, and Availability of systems and data according to their risk level.

Valorega’s information security program and policies are developed on the principles that (1) security is everyone’s responsibility and (2) self-management is best encouraged by rewarding the right behaviours.

Information Security Program and Scope:

Valorega has developed an information security program and implemented controls to meet and exceed all compliance requirements, and other applicable industry best practices.

On a high level, Valorega’s information security program covers:

• Inventory and protection of all critical assets
• Visibility into and the management of data lifecycle, from creation to retention to deletion
• Protection of data-at-rest, data-in-transit, and data-in-use
• Segmented network architecture
• Automated security configuration and remediation
• Centralised identity and access management
• Secure product development and Software Development Lifecycle
• Continuous monitoring and auditing
• Validated plan and practice for business continuity, disaster recovery, and emergency response
• End-user computing protection and security awareness training

The information security program and its policies and procedures cover all Valorega workforce members, including full-time and part-time employees in all job roles, temporary staff, contractors and subcontractors, volunteers, interns, managers, executives, and third parties.

The information security program is managed by dedicated security and compliance personnel.

The information security program, policies, procedures and controls are reviewed on a regular basis internally by cross functional team members.

The information security program is managed by dedicated security and compliance personnel. The information security program, policies, procedures and controls are reviewed on a regular basis internally by cross-functional team members.

Apart from signing non-disclosure agreements (‘NDAs’), we use IT infra and tools that meet industry-specific compliance standards such as SOC 2 Type II and ISO 27001. We use a defence-in-depth approach to provide security at the physical, logical, and data levels. If needed, we can also set up Windows Virtual Desktops (‘WVDs’) so that no user can download or transfer the data outside the client geography to meet data compliance requirements.

Some of the features of cloud storage tools used by us are below:

Data Level Security:

Data centres are hosted in secured locations and monitored with night vision cameras, 24*7 throughout the year. Our online storage servers are connected through SSL and secured with an RSA-based 2048-bit encryption key.

Disaster recovery:

The servers are well protected from all kinds of physical damage. The servers run on distributed grid architecture. In case of server damage, a copy of your files will be safely backed up in an alternate server and available without any noticeable delay.

Intrusion protection:

All files are first checked for viruses before being uploaded and stored on servers. The screening uses powerful Intrusion Detection and Intrusion Prevention Systems (IDS/IPS) and systems are secured from DDoS attacks.

Two-factor authentication:

A unique code is generated every time our resource logs into an account.

Encryption in transit and at rest:

Files in our online storage are encrypted at rest with 256-bit Advance Encryption Standard (AES). During transit, Perfect Forward Secrecy (PFS) generates a unique key for each session to encrypt files.

Admin-level controls:

As an admin, we can decide whether to allow users to share files only internally, or outside your team as well.

Transfer file ownership:

Transfer ownership of files from one user to another to keep them in the right hands.

Share links that expire:

We set expiration dates for our reports, research findings, or other vital documents while sharing them externally. After the expiration date, users won't be able to view the data.

Role-based permissions:

We give users only as much access as they need like a viewer, commenter, collaborator etc. We can block the download of files so that nobody can download files on their system.