Secure by design
We review how each feature handles data during discovery and architecture, so sensitive flows, permissions and integrations are planned before code is written.
Security
Security is part of how we build.
From the first architecture decision to ongoing maintenance, we design software to protect your data, your users and your business. Here is how we approach security across our services and our own product, FitCircle.
Our security commitmentsWhat you can expect when you work with us
- Security considered from discovery and architecture, not added at the end
- Encrypted connections (HTTPS/TLS) for data in transit
- Least-privilege access to systems and data
- Secrets and API keys kept on the server, never in frontend code
- Privacy by design, in line with India’s DPDP Act, 2023
- Ongoing updates and patching through Maintenance & Support
Our approach
How we approach security.
Security works best as a habit across the whole delivery process. These are the practices we apply on every engagement.
Secure development
We follow widely used guidance such as the OWASP Top 10, validate input, use parameterised data access, review code before release and keep dependencies up to date.
Access control
We apply least privilege to infrastructure and data, give each team member only the access they need, and enable multi-factor authentication on admin accounts wherever the platform supports it.
Data protection
Data in transit is protected with HTTPS/TLS. We configure encryption at rest where the hosting platform supports it, and collect only the data an application actually needs.
Secrets and credentials
API keys, tokens and passwords are stored on the server or in managed secret stores, never in frontend code or source control. User passwords are stored only as salted hashes, never in plain text.
Monitoring and response
We use logging and alerts to spot unusual activity. If an incident occurs, we act quickly to contain it and notify affected users and authorities as required by law.
Application security
Security we build into your applications.
The exact controls depend on your users, data and industry. We agree them with you during planning and build them in from the start.
Explore our services- Authentication and verificationSecure sign-in, OTP or two-factor verification, session timeouts and safe password reset flows.
- Role-based permissionsUsers see and do only what their role allows, across admin dashboards, portals and APIs.
- Audit trailsRecords of important actions, such as logins, approvals and data changes, for accountability and troubleshooting.
- Backups and recoveryAutomated backups and a recovery plan sized to how critical the system is to your business.
- Secure integrationsAuthenticated APIs, validated webhooks and carefully scoped credentials for every third-party connection.
- Ongoing maintenanceSecurity patches, dependency updates and monitoring after launch through our Maintenance & Support service.
Product security
Security in FitCircle.
FitCircle, our platform for fitness, health and wellness, is built with the same practices we use for client projects.
About FitCircle- Mobile number verification by OTP. One-time passwords confirm that you own the number before you can sign in.
- DLT-registered SMS. OTP and service messages use sender IDs and templates registered on the DLT platform, as required by TRAI.
- Encrypted connections. FitCircle is served over HTTPS on the web.
- We never ask for your OTP. Shibho Technologies and FitCircle will never ask you to share an OTP by phone, email or chat.
Responsible disclosure
Report a security issue.
If you believe you have found a security vulnerability in our website, FitCircle or software we have built, please tell us. We appreciate responsible reports and will work with you to fix the issue.
Email info@shibho.com Please use the subject line “Security report”.Please include
- A description of the issue and where you found it
- Steps to reproduce it, with screenshots if helpful
- The potential impact, as you understand it
We ask that you
- Do not access, change or delete other people’s data
- Do not disrupt our services or run denial-of-service tests
- Give us reasonable time to fix the issue before sharing it publicly
We will acknowledge your report, keep you informed as we investigate, and let you know when it is resolved. For how we handle personal data, see our Privacy Policy.
Have security requirements for your project?
Tell us about your data, users and compliance needs. We will suggest a practical, secure approach.