Encryption in transit
TLS 1.3 enforced on all product endpoints. No unencrypted fallback. Certificate management handled by the managed service provider.
Suntel360 · Security Measures
How security is implemented, not just promised
Every measure below is enforced in code, verified in operation, and documented for your reviewers. No assurance certifications are claimed anywhere on this site — implementation detail goes to your team directly.
- Six security domains, each with enforced controls
- Access checked on every request, not cached
- Written for procurement, not for a search engine
0
Security domains
0+
Individual measures
0
Shared credentials
0
Products isolated
Isolate
Tenant isolation enforced at the data layer — through tenant-scoped keys, tenant-scoped indexes, or explicit tenant checks on every record fetch. Isolation is enforced in the access path, not assumed by the interface.
Verify
Role-based access control resolved fresh on every request. An access change takes effect immediately rather than at next sign-in. ATS has no login of its own — it authenticates every request against HRMS employee records.
Audit
Every change written to a dedicated audit log rather than inferred from a row's current state. Immutable posted documents in ERP. Server-side document visibility in HRMS. No shared credentials across products.
Domain 01
Data protection
From the moment data enters the system to when it leaves, every layer is encrypted and scoped to your organisation.
Encryption at rest
AES-256 encryption applied to all stored data by default. Not an optional toggle someone has to remember to enable.
Tenant-scoped data keys
Each organisation's data is partitioned at the storage layer. A query without tenant context returns nothing.
Data residency controls
Data remains in the region agreed during deployment. No silent cross-region replication outside your control.
Key management
Encryption keys managed by the cloud provider's key management service. No hardcoded keys in application code.
Data masking in non-production
Sensitive fields masked or synthetic in staging and test environments. Production data never copied to lower environments without sanitisation.
Domain 02
Access and identity
Access is never assumed. It is resolved, checked, and logged on every request.
Role-based access control
Permissions resolve fresh against a live role lookup on every request. An access change takes effect immediately rather than at next sign-in.
Least-privilege by default
New users receive the minimum role required. Elevation requires explicit assignment and is logged.
Server-side permission enforcement
No client-side-only access control. Every endpoint validates the caller's scope before returning data.
Session management
Sessions expire after defined inactivity periods. Concurrent session limits configurable per organisation.
No shared credentials
Each product authenticates independently. ATS has no user store — it authenticates every request against HRMS employee records.
Service account isolation
Backend services hold only the permissions they require. A compromise of one component does not grant estate-wide access.
Domain 03
Infrastructure and network
The underlying platform is managed, version-controlled, and operated to a single standard across all four products.
Managed cloud compute
All products run on managed cloud infrastructure. There is no server for your team to patch or harden.
Infrastructure as code
Every environment is provisioned from version-controlled definitions. No manual configuration drift between deployments.
Network segmentation
Product tiers separated by network controls. Database tiers not directly reachable from the internet.
DDoS mitigation
Cloud provider DDoS protection enabled at the edge. Rate limiting applied at the application gateway.
Patch management
Operating system and runtime patches applied by the managed service provider. Patch status reviewed quarterly with your team on request.
Secrets management
API keys, database credentials, and certificates stored in the cloud provider's secrets manager and rotated on a defined schedule.
Domain 04
Application security
Security is built into the development lifecycle, not added after deployment.
Input validation
All user input validated against expected schemas on the server. No client-side validation trusted.
Output encoding
Dynamic content encoded before rendering to prevent injection attacks.
Dependency scanning
Third-party dependencies scanned for known vulnerabilities during CI/CD. Critical issues block deployment.
Secure defaults
Products ship with the most restrictive configuration. Security settings must be explicitly relaxed, not tightened.
Error handling
Generic error messages returned to users. Detailed error context logged server-side only.
API rate limiting
Rate limits enforced per user and per endpoint to prevent abuse and enumeration.
Domain 05
Monitoring and detection
If something changes, it is recorded and visible. If something is wrong, it is detected.
Dedicated audit logging
Every significant action written to a separate audit log. Logs include who, what, when, and from where.
Immutable audit trails
Audit logs cannot be edited or deleted by application users. Retention period configurable per organisation.
Anomaly detection
Unusual access patterns flagged for review. Configurable alerting thresholds per organisation.
Health monitoring
Service health, error rates, and latency monitored continuously. Alerting integrated with on-call rotation.
Log correlation
Logs from all four products correlated by organisation ID. A cross-product event trace is reconstructible.
Security event alerting
Failed login attempts, privilege escalations, and data access anomalies generate security alerts.
Domain 06
Incident response and recovery
When something goes wrong, the path to recovery is defined, tested, and communicated.
Automated backups
Database backups taken on a defined schedule. Backup integrity verified on each run.
Point-in-time recovery
Recovery to any point within the retention window. Recovery time objective defined per product.
Incident classification
Security incidents classified by severity. Response procedures defined for each level.
Notification commitments
Customer notification for confirmed data breaches within agreed timeframes.
Post-incident review
Significant incidents followed by a written review. Findings tracked to remediation.
Business continuity testing
Recovery procedures tested periodically. Test results reviewed with customer security teams on request.
Domain 07
Compliance and governance
Governance is not a checkbox. It is enforced through policy, process, and tooling.
Access reviews
User access reviewed on a defined schedule. Orphaned accounts identified and deprovisioned.
Policy enforcement
Security policies codified in code and process. Deviations detected and remediated.
Sub-processor management
Third-party sub-processors evaluated and documented. Changes communicated to customers.
Security documentation
Architecture documentation, control descriptions, and evidence packages maintained and current.
Change management
All changes to production infrastructure and application code follow a defined review process.
Customer security engagement
Security questionnaires completed by the engineering team. Architecture sessions conducted under NDA.
1
Design
Every product is built with tenant isolation, role-based access, and audit logging as first-class concerns — not afterthoughts.
2
Deploy
Infrastructure provisioned from version-controlled definitions. Managed cloud compute and storage. No manual configuration.
3
Operate
Access re-checked on every request. Changes written to dedicated audit logs. Encrypted in transit and at rest by default.
4
Review
Procurement-ready documentation available on request. Your reviewers get implementation detail in writing, under NDA if needed.
Ask us directly
What this page does not answer
These depend on your deployment and your requirements, so publishing a generic answer would be worse than none. Bring them to the first security call and you will get specifics.
- Exact cipher suites and TLS configurations in use
- Penetration testing scope, frequency, and remediation SLA
- Your organisation's specific compliance questionnaire
- Detailed infrastructure topology under NDA
- Sub-processor security attestations
- Disaster recovery test results from the last 12 months
- Audit log retention periods and export formats
WORKFLOW EVALUATION SESSION
Need our security measures documented?
Tell us what your review requires — control mapping, architecture session, or evidence package — and we will send it.